Account & security
These two tabs cover your personal account and its security — user-scoped, not tied to whichever workspace is active.
Account
Two cards: Profile (display name, plus the email-change flow covered below) and Change password.
Profile
Display name
Change password
Current password
New password
Password rules shown at submit time: a current password is required, the new password must be at least 8 characters, and confirmation must match. There's no avatar upload and no account-deletion option here — the only deletion control anywhere in the app is workspace deletion in Danger Zone.
Changing your email
Email is its own verify-first flow, separate from the display-name save above — a divider inside the same Profile card separates the two. Enter the new address and click Send confirmation; nothing about your account changes yet.
Email address
A confirmation is on its way to alex@meridiancorp.com. Open it to finish updating your email — until then, alex@meridian.co keeps working exactly as before.
Your current email keeps working for login exactly as before until you click the confirmation link — it's stored separately as a pending change, not swapped in immediately. Submitting again while a change is already pending is fine; it just replaces the pending address with whichever one you send to next, and the banner always reflects the most recent request.
Opening the confirmation link (which expires after 1 hour and works only once) lands on a public Confirm your email page:
Confirm your email
Confirming the new email address for your ForgeSend account.
Your email address has been updated. For your security, you've been signed out everywhere — log in again with your new address.
Confirming the change signs you out everywhere, not just on the device that opened the link — every existing session's login token stops working, forcing a fresh login on every device once the address actually changes. A separate email goes to your old address the moment it happens, so you'd notice if you didn't make the change yourself.
Security
The Security tab is entirely about two-factor authentication (2FA) — a real, working feature, unlike the Account tab above.
Authenticator app not enabled
Add a verification step before workspace access is granted.
Clicking Enable 2FA shows a QR code to scan with an authenticator app, plus a field to confirm setup with the resulting 6-digit code.
Authenticator code
Once confirmed, a one-time screen shows your backup codes with the warning "Save these backup codes now. They will not be shown again." — a Copy codes button and a Done button close it out. From then on, the tab shows "Authenticator app enabled" with a green ENABLED badge and your remaining backup-code count, and disabling it requires entering a current authenticator code, not your password.
This is the same 2FA that gates login — an account with it enabled is asked for a code at /login/2fa after a normal password sign-in, as covered in Introduction. There's no "active sessions" or "sign out other devices" control anywhere in Settings — 2FA is the only account-security control that exists today.
Where to go next
Next: Workspace & billing