Security4 min read
Confirm it's you before anything risky
Deleting, revoking and changing access now ask for your password and 2FA code. Here's why, and how it works.
Sessions last a while, which is convenient. It also means a laptop left open, or a stolen session cookie, could be used to do real damage. So the most sensitive actions now ask you to prove it's still you.
What asks for it
- Deleting a project, an environment, a secret or a whole workspace
- Revoking a secret
- Changing someone's role or removing them
- Inviting people, and creating API tokens (they can read values)
How it works
You enter your password, plus the code from your authenticator app if you use two-factor authentication. After that, you won't be asked again for 10 minutes. Signing in counts too, so you're not asked twice in a row.
The action you started continues once you've confirmed: no need to click Delete again. Things that only reduce access, like revoking an API token, don't ask.
Under the hood
The check happens on the server, after it has decided you're allowed to do the action at all, so people without access still see a plain “not found”. Wrong passwords and codes are limited to five tries every five minutes.
