Backup codes page

Account deactivation state page naming who deactivated the account and when, listing what reactivation restores, and linking directly to the named admin for recovery.

New device verification gate showing device, location, time, and account with approve and deny actions and an honest account-lock security note.

Email change confirmation page showing the new and old address with timestamp and device, a lock account alarm for unauthorized changes, and a dual address notice.

Password reset form that openly explains its anti enumeration response and states reset link timing facts.

Workspace entry page for invited and domain-matched users with a member preview, join or request buttons, and a note that joining is visible to admins immediately.

Account lockout page stating the 15-minute duration, a password reset shortcut, and the reassurance that lockouts are never permanent.

Passwordless sign in showing both the request and sent states with expiry and resend throttle facts.

A required two factor enrollment gate with three method rows ranked by strength, the authenticator app preselected, a grace period deadline, and a skip link.

OAuth connecting state card with a Spinner, three step rows showing progress for a GitHub org link, and fallback links if the page hangs.

Third party app authorization card listing granted scopes and explicit exclusions, the acting account, and authorize or cancel actions with a revoke note.

Centered auth card prompting passkey enrollment with three benefit rows, a device save target panel, and a skip fallback that keeps the existing password active.

A forced password rotation gate with current and new password fields, a policy panel explaining the deadline, and a reset by email fallback.