docs: add an Account Security page - #29
Merged
Merged
Conversation
MFA, passkeys and recovery codes were live in the product but documented
nowhere in customer-facing docs. security/authentication.mdx is entirely about
signing API requests with SigV4 despite its generic title, so a reader looking
for account login found nothing.
New security/security/account-security.mdx covers sign-in methods, two-factor
enrolment, passkeys, recovery codes, step-up re-authentication, and password
changes.
Every detail verified against the console source rather than inferred:
- Factor types from the MfaEnrollment union in shared/src/api/me.ts
('authenticator' | 'webauthn-roaming' | 'webauthn-platform'), with the
dashboard labels taken from formatEnrollmentType in MfaSettings.tsx
("Authenticator app (OTP)", "Security key", "Device biometrics").
- No SMS or email factor exists in that union, confirming they are not offered.
- PASSKEY_PER_USER_LIMIT = 20.
- The four step-up-gated routes: delete-mfa-enrollment,
regenerate-recovery-code, delete-passkey, disable-mfa, all via the
require-mfa middleware.
- Settings section names and the password-change flow from SettingsPage.tsx.
Also: a disambiguation note at the top of authentication.mdx pointing account
questions here, and a pointer from the dashboard walkthrough's "Signing in"
section. No em dashes, per house style.
Kept free of links to the Compliance page (PR #28) so this builds standalone
on main.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents MFA, passkeys and recovery codes, which are live in the product but appeared nowhere in customer-facing docs until now.
Why a new page rather than extending an existing one
security/authentication.mdxis entirely about signing API requests with SigV4, despite the generic title. Mixing account login into it would blur two different things: who you are when you log into the dashboard, versus how a request is signed. So this adds a separate page and puts a disambiguation note at the top ofauthentication.mdxpointing here, since the title does invite the question.Every detail verified against the console source
This is the first public documentation of MFA, so nothing here is inferred:
MfaEnrollmentunion inshared/src/api/me.ts:'authenticator' | 'webauthn-roaming' | 'webauthn-platform'. No SMS/email member exists.formatEnrollmentTypeinMfaSettings.tsxPASSKEY_PER_USER_LIMIT = 20require-mfamiddleware:delete-mfa-enrollment,regenerate-recovery-code,delete-passkey,disable-mfaSettingsPage.tsxemailVerifiedonMeResponse, plus the existing dashboard walkthroughFraming
Written as security posture rather than a feature list. The deliberate exclusion of SMS and email codes is stated as the strength it is (SIM-swap and mailbox-compromise resistance), and step-up re-authentication is called out because it means someone with a hijacked open session still cannot strip the account's protections.
Also in this PR
app/overview.mdx"Signing in" gets a pointer here.authentication.mdxgets the disambiguation note.llms.txtandllms-full.txt.Independence
Deliberately contains no link to the Compliance page from #28, so this builds standalone on
mainand the two can merge in either order. Once both land, the "Related" sections are worth cross-linking.Whichever of this, #27 and #28 merges later will hit a trivial adjacent-line conflict in the
sidebars.jsSecurity block and the mirrors.Verification
npm run buildsucceeds onmain(onBrokenLinks: "throw")🤖 Generated with Claude Code