2fa

Local accounts can enable TOTP from Profile settings. Setup requires the current password, verification of the first six-digit code, and acknowledgement of one-time recovery codes. Users can disable TOTP, regenerate recovery codes, list/revoke trusted devices, and revoke every trusted device.

Challenge attempts are rate-limited. Recovery codes are hashed at rest and shown only when generated. See docs/security/two-factor-authentication.md for the detailed trust model.