Sign-in and MFA hardening
Sign-in now binds each login to your browser with PKCE, MFA is enforced on every server action, and changing a second factor needs a fresh MFA check.
A batch of sign-in and account security changes from our launch audit:
- PKCE on sign-in. Each login flow is bound to the browser that started it.
- MFA everywhere it is required. Owners and admins without MFA were refused by the API but not by every page action. Now both enforce it. A one-person workspace gets seven days to set it up.
- Fresh checks for sensitive changes. Adding or removing a passkey, replacing your authenticator app or regenerating recovery codes needs an MFA check from the last ten minutes. Turning off a factor signs out your other sessions.
- No account probing. Sign-up answers the same way whether or not an address already has an account, and the owner of that address gets an email instead.
- Race fixes. A one-time code can't be used twice, and failed MFA attempts are counted before they are checked.
More about how we protect accounts is on the security page, and roles are covered in members.