You can now log in with a recovery code if you lose your authenticator — plus stronger session protection

Two account-security improvements shipped together. If you've enrolled two-factor and lose access to your authenticator app, you can now finish signing in with one of the recovery codes you saved at enrollment. Separately, we strengthened how Stela responds when it detects suspicious activity on a session — affected sessions are shut down and the event is recorded to your Activity feed. Two changes, both on the login and session-security path: Use a backup code at login if you can't get to your authenticator — On the login screen, after you enter your password and reach the two-factor step, there's now a 'Use a recovery code instead' option. Type one of the 10 codes you saved when you turned on two-factor, and you're in — the code is consumed on use, just as before. Your Profile's Security tab also warns you when you're down to three or fewer remaining recovery codes so you can generate a fresh batch in advance. Suspicious session activity is shut down and recorded — If Stela detects signs that one of your sessions may have been compromised, it now signs out every related session and records the event in your Activity feed. You'll also reliably see Activity entries for other security-relevant events on your account, like rejected passwords that appear in known data breaches and failed attempts to change sensitive account settings.