Account security

Email verification

Every account, including those created with GitHub, verifies its email address with a 6-digit code before it can create resources or deploy. See Create an account.

Two-factor authentication (2FA)

Protect your account with codes from an authenticator app (such as 1Password, Google Authenticator or Authy).

Turn it on

1. Go to Settings → Security → Two-Factor Authentication, click Setup 2FA and enter your password.
2. Scan the QR code with your authenticator app (or enter the key manually).
3. Enter the 6-digit code from the app and click Verify & Enable.
4. Save your 10 backup codes somewhere safe. Each works once and lets you in if you lose your device.

From then on, after your password you’ll be asked for an Authentication code: a 6-digit code from your app, or an 8-character backup code. This also applies when you sign in with GitHub and when you use hivepod login --no-browser.

To get new backup codes, click New backup codes and enter your password and a code from your app. The old codes stop working at once.

DockHive emails you whenever 2FA is turned on or off.

Turn it off

Click Disable, then enter your password and a code from your app (or a backup code). Turning 2FA off deletes your backup codes and signs you out everywhere.

Passwords

• Change your password in Settings → Security.
• Forgot it? Use Forgot password on the sign-in page. The link works once, for one hour.
• Changing or resetting your password signs you out everywhere immediately. API keys keep working (so CI doesn’t break); DockHive emails you a list of your active keys so you can revoke any you no longer trust.
• Passwords must be at least 8 characters and not too common or too similar to your email.

Sign-in protection

• After 5 failed sign-ins in 15 minutes from one network, that network is paused for 15 minutes. If many networks fail, sign-in asks for an extra bot check, so nobody can lock you out of your own account.
• Five wrong 2FA codes pause 2FA sign-in for 15 minutes, and DockHive emails you.
• Sign-up, sign-in and password resets include a quick, automatic security check against bots.
• DockHive emails you on every sign-in (password, GitHub or Google), and when an API key is created. If it wasn’t you, change your password and revoke unknown keys.
• Changing your account email needs your password (and a 2FA code if 2FA is on). DockHive emails your old address an undo link for 7 days, and the change signs you out everywhere.
• hivepod login and dockhive login from the browser need a sign-in within the last 15 minutes; otherwise you’re asked to sign in again.
• 2FA secrets and connected GitHub/Google tokens are encrypted at rest; backup codes and one-time links are stored only as hashes.

API keys

Use API keys with the narrowest access you need (Read only where possible) and an expiry. Keys can never change your account, security or billing settings.

Security model

What DockHive does, and what stays with you.

Network

• Databases are closed by default. Each database has its own firewall, in place before the database is reachable; only the IPv4 addresses, apps and pods you allow can connect. A database that any internet address can reach is flagged Open to the internet in the console, CLI and MCP tools.
• App and pod rules only ever match your own workloads, in the database’s region.
• Databases, apps and pods can’t reach DockHive’s internal systems.
• App, pod and workspace addresses are served over HTTPS; databases require TLS by default.

Isolation

• Every app, database, n8n workspace and HivePod is kept apart from everyone else’s, with its own resource limits. Pods can’t open connections to each other.

Access

• In a team workspace, viewers can see resources but can’t change them or read database passwords. Read only API keys can’t read database passwords either.
• Secrets (app variables, repository tokens, database passwords) are encrypted at rest and build logs hide variable values. See Data and regions.

Your part

• Allow the narrowest sources you can and avoid 0.0.0.0/0.
• Keep connection strings in app variables, not in code, and turn on 2FA.
• Database backups stay on the database’s server in its region. Keep your own copy of anything you can’t lose.

Report a security issue

Email [email protected].