[{"data":1,"prerenderedAt":509},["ShallowReactive",2],{"navigation_docs":3,"-docs-guide-account-security":170,"-docs-guide-account-security-surround":504},[4,8,45,125,135],{"title":5,"path":6,"stem":7},"TheSpider Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":44},"Getting Started","i-lucide-rocket","\u002Fdocs\u002Fgetting-started","docs\u002F1.getting-started",[14,19,24,29,34,39],{"title":15,"path":16,"stem":17,"icon":18},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F1.getting-started\u002F1.introduction","i-lucide-house",{"title":20,"path":21,"stem":22,"icon":23},"AI Setup Wizard","\u002Fdocs\u002Fgetting-started\u002Fai-setup","docs\u002F1.getting-started\u002F2.ai-setup","i-lucide-sparkles",{"title":25,"path":26,"stem":27,"icon":28},"Install the agent","\u002Fdocs\u002Fgetting-started\u002Finstallation","docs\u002F1.getting-started\u002F3.installation","i-lucide-download",{"title":30,"path":31,"stem":32,"icon":33},"Cloud quickstart","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F1.getting-started\u002F4.quickstart","i-lucide-zap",{"title":35,"path":36,"stem":37,"icon":38},"Connect over MCP","\u002Fdocs\u002Fgetting-started\u002Fmcp","docs\u002F1.getting-started\u002F5.mcp","i-lucide-plug",{"title":40,"path":41,"stem":42,"icon":43},"Pricing","\u002Fdocs\u002Fgetting-started\u002Fpricing","docs\u002F1.getting-started\u002F6.pricing","i-lucide-badge-dollar-sign",false,{"title":46,"icon":47,"path":48,"stem":49,"children":50,"page":44},"Guide","i-lucide-book-open","\u002Fdocs\u002Fguide","docs\u002F2.guide",[51,56,61,66,71,76,81,86,91,96,101,106,111,115,120],{"title":52,"path":53,"stem":54,"icon":55},"Configuration","\u002Fdocs\u002Fguide\u002Fconfiguration","docs\u002F2.guide\u002F01.configuration","i-lucide-settings",{"title":57,"path":58,"stem":59,"icon":60},"The agent","\u002Fdocs\u002Fguide\u002Fagent","docs\u002F2.guide\u002F02.agent","i-lucide-terminal",{"title":62,"path":63,"stem":64,"icon":65},"Campaigns","\u002Fdocs\u002Fguide\u002Fcampaigns","docs\u002F2.guide\u002F03.campaigns","i-lucide-layers",{"title":67,"path":68,"stem":69,"icon":70},"Campaign cadence","\u002Fdocs\u002Fguide\u002Faudit-workflows","docs\u002F2.guide\u002F04.audit-workflows","i-lucide-git-compare-arrows",{"title":72,"path":73,"stem":74,"icon":75},"Triage","\u002Fdocs\u002Fguide\u002Ftriage","docs\u002F2.guide\u002F05.triage","i-lucide-list-checks",{"title":77,"path":78,"stem":79,"icon":80},"PR gate","\u002Fdocs\u002Fguide\u002Fpr-gate","docs\u002F2.guide\u002F06.pr-gate","i-lucide-git-pull-request",{"title":82,"path":83,"stem":84,"icon":85},"Data handling & privacy","\u002Fdocs\u002Fguide\u002Fdata-handling","docs\u002F2.guide\u002F07.data-handling","i-lucide-shield-check",{"title":87,"path":88,"stem":89,"icon":90},"Author an audit methodology","\u002Fdocs\u002Fguide\u002Fmethodology","docs\u002F2.guide\u002F08.methodology","i-lucide-panels-top-left",{"title":92,"path":93,"stem":94,"icon":95},"Configure a custom model runner","\u002Fdocs\u002Fguide\u002Fcustom-runner","docs\u002F2.guide\u002F09.custom-runner","i-lucide-terminal-square",{"title":97,"path":98,"stem":99,"icon":100},"Runner troubleshooting","\u002Fdocs\u002Fguide\u002Ftroubleshooting","docs\u002F2.guide\u002F10.troubleshooting","i-lucide-wrench",{"title":102,"path":103,"stem":104,"icon":105},"Host an external execution agent","\u002Fdocs\u002Fguide\u002Fexternal-agent","docs\u002F2.guide\u002F11.external-agent","i-lucide-plug-zap",{"title":107,"path":108,"stem":109,"icon":110},"Refine","\u002Fdocs\u002Fguide\u002Frefine","docs\u002F2.guide\u002F12.refine","i-lucide-repeat",{"title":112,"path":113,"stem":114,"icon":65},"Audit profiles","\u002Fdocs\u002Fguide\u002Fprofiles","docs\u002F2.guide\u002F13.profiles",{"title":116,"path":117,"stem":118,"icon":119},"Account security","\u002Fdocs\u002Fguide\u002Faccount-security","docs\u002F2.guide\u002F14.account-security","i-lucide-shield-user",{"title":121,"path":122,"stem":123,"icon":124},"Org sign-in policy","\u002Fdocs\u002Fguide\u002Forg-sign-in-policy","docs\u002F2.guide\u002F15.org-sign-in-policy","i-lucide-lock-keyhole",{"title":126,"icon":127,"path":128,"stem":129,"children":130,"page":44},"Deploy","i-lucide-server","\u002Fdocs\u002Fdeploy","docs\u002F3.deploy",[131],{"title":132,"path":133,"stem":134,"icon":127},"On-prem overview","\u002Fdocs\u002Fdeploy\u002Fonprem","docs\u002F3.deploy\u002F2.onprem",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":44},"Reference","i-lucide-code","\u002Fdocs\u002Freference","docs\u002F4.reference",[141,146,151,156,160,165],{"title":142,"path":143,"stem":144,"icon":145},"API reference","\u002Fdocs\u002Freference\u002Fapi","docs\u002F4.reference\u002F1.api","i-lucide-code-xml",{"title":147,"path":148,"stem":149,"icon":150},"Concepts and glossary","\u002Fdocs\u002Freference\u002Fconcepts","docs\u002F4.reference\u002F2.concepts","i-lucide-book-marked",{"title":152,"path":153,"stem":154,"icon":155},"Runner contract","\u002Fdocs\u002Freference\u002Frunner-contract","docs\u002F4.reference\u002F3.runner-contract","i-lucide-file-json-2",{"title":157,"path":158,"stem":159,"icon":28},"Findings export","\u002Fdocs\u002Freference\u002Ffindings-export","docs\u002F4.reference\u002F4.findings-export",{"title":161,"path":162,"stem":163,"icon":164},"Agent CLI contracts","\u002Fdocs\u002Freference\u002Fagent-cli-json","docs\u002F4.reference\u002F5.agent-cli-json","i-lucide-braces",{"title":166,"path":167,"stem":168,"icon":169},"Agent downloads","\u002Fdocs\u002Freference\u002Fdownloads","docs\u002F4.reference\u002F6.downloads","i-lucide-hard-drive-download",{"id":171,"title":116,"body":172,"description":497,"extension":498,"links":499,"meta":500,"navigation":501,"path":117,"seo":502,"stem":118,"__hash__":503},"docs\u002Fdocs\u002F2.guide\u002F14.account-security.md",{"type":173,"value":174,"toc":485},"minimark",[175,184,189,208,211,229,232,240,244,247,301,312,319,326,329,332,337,362,365,369,380,387,402,406,447,451,454,474],[176,177,178,179,183],"p",{},"Everything here lives on ",[180,181,182],"strong",{},"Account → Security"," in the dashboard.",[185,186,188],"h2",{"id":187},"sign-in-methods","Sign-in methods",[176,190,191,192,195,196,199,200,203,204,207],{},"You can sign in with an email and password, and with ",[180,193,194],{},"Google",", ",[180,197,198],{},"GitHub"," or ",[180,201,202],{},"Microsoft"," when the\nserver has them configured. An organization can also have its own ",[180,205,206],{},"SSO"," connection (OIDC or SAML),\nset up by the operator.",[176,209,210],{},"A provider sign-in with an address that already has a TheSpider account joins that account only when\nboth sides have verified the address. Otherwise the login page says the account exists but is not\nlinked:",[212,213,214,222],"ul",{},[215,216,217,218,221],"li",{},"If the account is yours, sign in with its password and use ",[180,219,220],{},"Link Google \u002F GitHub \u002F Microsoft"," on\nAccount → Security.",[215,223,224,225,228],{},"If you never created it, or do not know its password, ",[180,226,227],{},"reset the password",". The reset email\nproves you own the mailbox and signs out every other session. Then link the provider.",[176,230,231],{},"Verifying the email address alone is not enough to take an account back: it keeps the existing\npassword and sessions.",[176,233,234,235,239],{},"You cannot unlink your last sign-in method, or the last one that an organization you belong to\nrequires (",[236,237,238],"code",{},"last_compliant_method",").",[185,241,243],{"id":242},"two-factor-authentication","Two-factor authentication",[176,245,246],{},"Add a second factor to every sign-in:",[248,249,250,263],"table",{},[251,252,253],"thead",{},[254,255,256,260],"tr",{},[257,258,259],"th",{},"Factor",[257,261,262],{},"Notes",[264,265,266,281,291],"tbody",{},[254,267,268,274],{},[269,270,271],"td",{},[180,272,273],{},"Passkey",[269,275,276,277,280],{},"Touch ID, Windows Hello, a phone or a security key. Needs HTTPS (or ",[236,278,279],{},"localhost","); on a plain-HTTP server the dashboard offers only the authenticator app.",[254,282,283,288],{},[269,284,285],{},[180,286,287],{},"Authenticator app",[269,289,290],{},"Any TOTP app (6 digits, 30 seconds). Scan the QR code or type the secret.",[254,292,293,298],{},[269,294,295],{},[180,296,297],{},"Recovery codes",[269,299,300],{},"Ten single-use codes, issued when you add your first factor. Store them somewhere safe. Generating new codes invalidates the old ones.",[176,302,303,304,307,308,311],{},"After a password, Google, GitHub, Microsoft, SSO or email-link sign-in, an enrolled account must\nverify a factor within ",[180,305,306],{},"15 minutes",". Until then the session can only finish verification: other\npages and the API answer ",[236,309,310],{},"mfa_required",".",[176,313,314,315,318],{},"Adding or removing a factor, changing your password, linking or unlinking a provider and creating\nnew recovery codes need a ",[180,316,317],{},"recent"," sign-in. For an enrolled account that means a second-factor check\nin the last 10 minutes; otherwise a sign-in in the last hour. The dashboard asks you to confirm when\nit is needed.",[320,321,322,325],"note",{},[180,323,324],{},"Verify your email first."," When the server sends email, you must verify your address before you add\na second factor. This stops someone who signed up with your address from locking you out.",[176,327,328],{},"Five wrong codes in one session sign that session out. Ten wrong codes across sessions pause\nverification for 15 minutes and email you.",[176,330,331],{},"The dashboard reminds you to add a second factor: a banner on every page, and a prompt on each new\nsign-in that you can postpone (for a day, or a week after a provider sign-in). Agents, the CLI and MCP\nnever see it.",[333,334,336],"h3",{"id":335},"lost-your-factors","Lost your factors",[212,338,339,346,352],{},[215,340,341,342,345],{},"Use a ",[180,343,344],{},"recovery code"," on the verification page.",[215,347,348,351],{},[180,349,350],{},"Cloud:"," contact support. After confirming your identity, support resets your second factor,\nwhich signs you out everywhere and emails you.",[215,353,354,357,358,361],{},[180,355,356],{},"On-prem:"," an organization owner can reset a member's second factor, and the operator can run\n",[236,359,360],{},"bun run src\u002Fauth-admin.ts reset-second-factor --email \u003Caddress>"," on the server.",[176,363,364],{},"Passkeys are bound to the server's hostname. If it changes, use a recovery code or the authenticator\napp, or ask for a reset.",[185,366,368],{"id":367},"sign-in-alerts","Sign-in alerts",[176,370,371,372,375,376,379],{},"TheSpider remembers your browsers (a ",[236,373,374],{},"thespider_device"," cookie, stored on the server only as a hash)\nand the networks you sign in from (a \u002F24 or \u002F56 network prefix, stored only as a keyed hash). When a\nsign-in comes from a browser ",[180,377,378],{},"and"," a network it has not seen before, you get an email, \"New sign-in\nto TheSpider\", with the time, method, browser and network. On a server without email, the next page\nyou open shows the same notice instead.",[176,381,382,383,386],{},"If it was not you, choose ",[180,384,385],{},"Secure my account"," (the email link opens a confirmation page; nothing\nhappens until you confirm). That:",[388,389,390,393,396,399],"ol",{},[215,391,392],{},"signs out every browser session and forgets every remembered browser,",[215,394,395],{},"revokes CLI tokens and MCP authorizations created since that sign-in (older ones are listed on\nAccount → Security for review),",[215,397,398],{},"removes the password if the intruder used one (sign in with a reset link or a provider), and",[215,400,401],{},"emails you a confirmation.",[185,403,405],{"id":404},"other-protections","Other protections",[212,407,408,413,423,436],{},[215,409,410],{},[180,411,412],{},"Password reset signs out every session.",[215,414,415,418,419,422],{},[180,416,417],{},"Breached passwords are refused"," on sign-up, password change and reset (",[236,420,421],{},"PASSWORD_COMPROMISED",").\nThe check sends only the first five characters of the password's SHA-1 hash to Have I Been Pwned.\nIt is on in Cloud and off on-prem by default.",[215,424,425,428,429,432,433,311],{},[180,426,427],{},"Repeated wrong passwords"," lock that email's password sign-in for a minute, doubling up to 15\nminutes (",[236,430,431],{},"TOO_MANY_ATTEMPTS","); ten from one network lock that network for 15 minutes. Each attempt is\nreserved before the password is checked: a successful sign-in clears the count, a wrong password\nkeeps it, and anything else gives it back, so many attempts sent at once are limited the same way as\nattempts sent one by one. A browser that signed in to the account before, a provider sign-in and a\npassword reset all still work, and a ",[180,434,435],{},"completed password reset lifts the lock",[215,437,438,439,442,443,446],{},"The sign-in, password-reset and verification-email endpoints accept only ",[236,440,441],{},"application\u002Fjson"," bodies\n(",[236,444,445],{},"415 UNSUPPORTED_MEDIA_TYPE"," otherwise).",[185,448,450],{"id":449},"sessions-agents-and-integrations","Sessions, agents and integrations",[176,452,453],{},"Account → Security lists:",[212,455,456,462,468],{},[215,457,458,461],{},[180,459,460],{},"Signed-in sessions",", with browser, IP, sign-in method and whether two-factor was verified. Sign\nout one, or every other session.",[215,463,464,467],{},[180,465,466],{},"Agents and integrations",": your CLI logins, CLI tokens and MCP authorizations, with how the\napproving session signed in. Revoke any of them.",[215,469,470,473],{},[180,471,472],{},"Security activity",": the last 30 security events (factors, linked sign-ins, password changes,\nnew sign-ins).",[176,475,476,477,480,481,311],{},"See also ",[478,479,121],"a",{"href":122}," and\n",[478,482,484],{"href":483},"\u002Fdocs\u002Fguide\u002Ftroubleshooting#sign-in-and-account","Troubleshooting",{"title":486,"searchDepth":487,"depth":487,"links":488},"",2,[489,490,494,495,496],{"id":187,"depth":487,"text":188},{"id":242,"depth":487,"text":243,"children":491},[492],{"id":335,"depth":493,"text":336},3,{"id":367,"depth":487,"text":368},{"id":404,"depth":487,"text":405},{"id":449,"depth":487,"text":450},"Two-factor authentication, passkeys, recovery codes, sign-in alerts, sessions and linked sign-ins","md",null,{},{"icon":119},{"title":116,"description":497},"BqevShHTBIQFA_Gnfn5_CkgE-MZXqnhvAWetAwdJjlo",[505,507],{"title":112,"path":113,"stem":114,"description":506,"icon":65,"children":-1},"What Security, Bugs, Hygiene and Pipeline find, and what they don't",{"title":121,"path":122,"stem":123,"description":508,"icon":124,"children":-1},"Require Google, GitHub, Microsoft or SSO sign-in and restrict members to your email domains",1793113502435]