Account security

Two-factor authentication

Turn on Two-factor authentication in your account settings and scan the code with an authenticator app. Save the backup codes somewhere safe: when you sign in without your phone, choose Use a backup code.

Sessions

Sign-in sessions last up to 7 days.

To change your email address, enter your current password. If your account has no password, sign out and in again, then make the change within 10 minutes. M1rror sends a confirmation link to the new address, which works for 24 hours, and a notice to the old address with a link to undo the change, which works for 7 days. When you confirm, your other sessions are signed out.

Agent tokens

Agent tokens are shown once and stored only as a hash. They expire after at most 90 days, can be limited to one project, and can be revoked in Settings › Agent access at any time. Removing a member revokes their tokens for that workspace.

Report a security issue

Email [email protected] with a description and steps to reproduce. Please don't open a public issue, and don't include live customer data or secrets in the report. This is the address in the repository's SECURITY.md.