Account protection
Recovery safety.
Review OAuth, passkeys, 2FA, sessions, login risk, recovery, and admin security controls from one protected workspace.
| Recovery area | Control | Detail |
|---|---|---|
| Recovery requests | Rate-limited and lockable | Repeated failed recovery attempts can be locked or escalated for admin review. |
| Recovery codes | Shown once | Stored as hashes and never exposed after initial generation or regeneration. |
| Final factor removal | Step-up required | Disabling protective factors requires recent step-up and never deletes account progress. |