Confirm It's You Before Sensitive Account Changes
Sensitive changes now ask you to confirm it's you, and new ways into your account are emailed to you, so a session left signed in on a shared or lost device can't be used to add a way in unnoticed.
What's changed
- Even when you are already signed in, you are asked to confirm it's you before you add or remove a passkey, create or edit an API token, authorize the danube CLI, change your email address, set a password, turn two-factor authentication on or off, or view or regenerate your recovery codes
- The same goes for creating an S3 access key or widening what one reaches, creating a container registry key, an SFTP user or an SSH key, inviting a team member or changing a member's role, saving your project's webhook address or regenerating its secret, rotating a database password, signing out a browser session, changing your session security settings, removing a linked Google or GitHub sign-in, and deleting your account
- Confirm with your password, a passkey you already added, a code from your authenticator app or, if you sign in with Google or GitHub and have no password, a 6-digit code we email you. A confirmation lasts 15 minutes, so several changes in a row ask once, and five wrong attempts pause confirming for 15 minutes
- Adding, widening or removing a way in also emails your account's address, saying what changed, when, and from which IP address and browser: a passkey, an API token or the CLI, an S3 access key, a registry or SSH key, SFTP access, an invitation, a webhook address or secret, a database password rotation, two-factor authentication turned on or off, new recovery codes and a linked sign-in. You can't turn these emails off
- A change of email address is reported to the old address and a password change sends an email too; five wrong current passwords pause changing it for 15 minutes
- Changes made through the API with a token send the same email, for example when a script creates an S3 access key or an SSH key
- Signing in with Google or GitHub links to an existing account only when the provider says it verified the address, and we email you whenever a sign-in is linked. Profile > Sign-in and security lists your linked sign-ins, and you can't remove the only way you can sign in