Security
- An authenticator code is refused if it is used a second time, on the web and in the mobile app.
- Recovery codes were already single-use.
- The mobile app lock screen now says it is not the two-factor authenticator.
Changelog
Two-factor codes can be used only once
Shipped to production on October 20, 2026.
Every server you connect gets these improvements automatically — the agent updates itself.