Changelog

Org-enforced 2FA, step-up checks, and account controls

  • New
  • Improved

Account and organization hygiene, the kind of thing a B2B customer checks in a security questionnaire. Personal organizations keep working like any other organization.

Two-factor auth per organization

An owner can require two-factor auth for the organization. A member without an authenticator app cannot open that organization until they set one up. Their personal settings, the organization switcher, and Leave stay available so they are never stuck.

Step-up for sensitive actions

Cancelling billing, opening the billing portal, deleting an organization, changing its two-factor rule, signing out other devices, and linking or unlinking a sign-in method now ask for a password or authenticator code first. An authenticator code works once, even across different actions. Linking a new Google or GitHub account goes through a single-use, two-minute approval, so a stolen session cannot quietly add a way back in. A support admin impersonating a user is refused on all of these actions.

Account controls

Users can delete their account, with a confirmation email. Organizations where they are the only member are deleted with them. If they are the only owner of a larger organization, the longest-standing member takes over. The sessions list shows browser and last activity, and one button signs out every other device. The login page offers passkey sign-in.

Organizations

Members can leave an organization, except its last owner. An owner can transfer ownership by promoting another member, and stays an owner. Admins cannot invite someone at or above their own role. Expired invitations no longer take up seats, and the invite list shows when each one expires. A header inbox shows four events: invitation accepted, removed from an organization, payment needs attention, and you are now the owner.

Under the hood

Chat attachments are stored per organization and user, so a message cannot reuse a file from another organization. Older attachments still display. Gitleaks now scans every pull request for committed secrets.