Account recovery: 2FA backup codes (show-once/download/regenerate, usable at the login challenge), forgot-password via 2FA or backup code (email link gated on a configured mailer), and a clusev:reset-admin CLI lockout fallback. Resets rotate remember_token; codes consumed atomically. WebAuthn/YubiKey remains a Phase-2 spec. See CHANGELOG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| superpowers | ||
| install-update-design.md | ||
| session-handoff.md | ||
| v1-ui-review.md | ||