coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): name the audited recovery path in lost-authenticator help (F3); close U08 follow-ups
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 40s
Details
Account journey acceptance / journeys (push) Successful in 1m53s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
tegwick 2026-10-21 00:01:47 +02:00
parent 9787cd7523
commit 15c41970a6
5 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/user_engine/web.py
View file

@ -1990,7 +1990,7 @@ This account site cannot currently confirm whether an authenticator is enabled f
<p>Opening the setup page does not activate two-step verification. To cancel unfinished setup, open All Tokens, select the pending token, and choose Delete. A confirmed authenticator cannot be removed or replaced from this password-only management session; ask your administrator to use audited authenticator recovery.</p></details>
<details><summary>A code is rejected, or I have lost my authenticator</summary>
<p>Use the newest code for the correct account and check that your device sets its time automatically.
If you cannot use your authenticator, follow the sign-in service's recovery instructions or ask your tenant administrator for account recovery.
If you cannot use your authenticator, ask your tenant administrator for audited authenticator recovery. They confirm your identity and remove the lost authenticator; you then sign in with your password and set up a new one here. There is no self-service bypass.
Never send your password, QR code, or verification codes to an administrator.</p></details></section>
<section><h2>Password help</h2><p>Use password recovery on the sign-in page.
If the recovery message does not arrive, ask your tenant administrator for a new password setup link.