Account security

Signing in#

Sign in with your email and password, a passkey, or GitHub/Google. Under Settings → Security:

• Update password: use a long, random password; passwords found in known breaches are refused.
• Passkeys: Add passkey to sign in without a password from that device (Face ID, Touch ID, Windows Hello, a security key). Name each one so you recognize it later; Remove deletes it.
• Two-factor authentication: Enable 2FA, scan the QR code with an authenticator app (or enter the key manually) and confirm with a code. From then on, signing in with a password asks for a 6-digit code.
• Recovery codes: shown when you enable 2FA; View recovery codes and Regenerate codes later. Store them in a password manager — each works once if you lose your authenticator.

Approval passkey#

Separate from your sign-in passkeys, the approval passkey confirms high-risk actions and is held by Zefily's separate signing service. See Approvals and passkeys.

Confirming sensitive views#

Revealing secrets — an admin login, a database password, the .env, a backup repository password — asks you to confirm your password (or passkey) again if you have not done so recently, and is written to the audit log.

Appearance and language#

• Settings → Appearance: light, dark or system theme.
• The language button at the top of every page switches between English and Turkish; your choice is remembered for your account and used for emails too.

Profile and account deletion#

Settings → Profile changes your name and email address (a new address must be verified). Delete account removes your account and the organizations you alone own; it asks for your password.