Security
- Workspace API tokens get scopes (read, deploy, ops) and an expiry, which defaults to one year. Existing tokens keep every scope and never expire, so current integrations keep working.
- If a workspace requires 2FA, members without it are limited to Account, Security until they set it up.
- Sign-in has rate limits, 2FA code attempts count toward lockout, and recovery codes are 12 characters.
- Agent requests carry a timestamp and a nonce, which protects against replay.