Security
- Two-factor auth with recovery codes, optionally required workspace-wide, plus team roles (owner/admin/member).
- Step-up 2FA before running a command or enabling remote actions — a hijacked session still can’t touch your servers.
- Brute-force lockout, new-login email alerts, an audit log and one-click “sign out everywhere.”