Account security

Account security

The right habits and tools available to keep your account, and therefore your services, under your sole control.

Login and password

• Linked accounts: sign in via GitHub or Discord in addition to (or instead of) your password. Linking is managed in Settings → Linked accounts. Unlinking a provider is immediate.
• Password: changeable in Settings → Security; a strength indicator guides you. If the account was created via OAuth, you can add a password to have both methods available.
• Forgotten password: email reset is available from the login page.

Active sessions

Settings → Security lists your sessions (device, IP address). A device you don't recognize? Disconnect the session (access is cut off immediately), then change your password.

API keys

Each API key is an access point to your account: minimal scopes, expiration for CI keys, immediate revocation at the slightest doubt. Never put a key in a repository: use your CI's secrets.

Your data

• Export: download an archive of your data from Settings → Security.
• Account deletion: from the same page. This operation is permanent: services stopped, data and backups deleted. Export what needs exporting first, then cancel your subscriptions to avoid any residual charge.

Application secrets

The security of your services matters as much as that of your account:

• Secrets and tokens go in environment variables, never in code or the image.
• An exposed secret (public commit, log) must be regenerated at its issuer, not just on your end.
• Credentials generated for your databases are specific to each instance: a leak only compromises that one.

Any doubt about a compromise? Change your password, revoke API keys, disconnect all sessions, in that order (it takes a minute), then open a ticket if needed.