Account Security
Active sessions, changing your password, and the emails we send when something about your account's protections changes.
Everything on this page lives at Account → Security in the control panel. Two-factor authentication and passkeys have guides of their own — two-factor authentication and passkeys — this one covers the rest.
Active sessions
Active sessions lists every browser currently signed in to your account, with the device, IP address, and when it signed in. The session you are reading this from is pinned to the top and labelled.
This is the part people miss, so it is worth stating plainly:
Changing your password does not end sessions that are already signed in. Neither does turning on two-factor authentication, and neither does revoking trusted devices. All three govern the next sign-in.
If you think someone else is in your account, Sign out everywhere else is the control that removes them. It ends every session except the one you are using. You can also sign out a single session from its row, which is what you want for a laptop you no longer have rather than a suspected intruder.
Changing your password
Change password changes it in place, without the emailed reset round-trip. You will need your current password — if you have forgotten it, use the reset link instead and we will email you one.
Sign out everywhere else is ticked by default here, and we would suggest leaving it. A password change prompted by a suspected leak accomplishes very little if the other person's session survives it.
If your password is rejected
We check new passwords against public breach corpora. A rejection does not mean your password is too short or too simple — it means that exact password appears in a known breach dump, which puts it near the top of the list an attacker tries first. Almost always this is a password reused from a site that was breached years ago.
The check is anonymised: only a short, partial fingerprint of the password is used to query the breach dataset. Your password itself never leaves our servers, and neither does anything that could be used to reconstruct it.
Security emails
We email you when something changes that affects who can reach your account:
- Two-factor authentication turned on or off
- New recovery codes issued
- Your password changed
- A sign-in method added or removed
- Trusted devices revoked
These are deliberately hard to turn off, because they are how an account takeover gets noticed. An attacker who has your password can disable your second factor — the email is what tells you.
If one of these arrives and it wasn't you, someone else has your password. Change it, then sign out every other session — both from Account → Security — and contact support if anything still looks wrong.
We will never email you a recovery code, a two-factor secret, or a link that asks for your password. Anything that does is not from us.
Two-Factor Authentication
Add a second step to sign-in so a stolen password is not enough to reach your servers, domains, and secrets on its own.
App Deployment Templates
Commit a .datablock/app.yaml to your repository to predefine your app's build, runtime, and environment configuration — the deploy wizard fills itself in from it.