Account and security

Local authentication

UnrealOS currently uses local email and password authentication. Passwords are slow-hashed, sessions use HTTP-only cookies, and verification and reset tokens are short-lived and stored only as hashes. Keep a unique password for this service and use an organization-managed mailbox for recovery.

Credential handling

API keys and device credentials are shown only at issuance, stored as hashes, and scoped to a project or environment. Provider secrets are protected by UnrealOS and are never displayed after setup. Never paste credentials into operation notes, screenshots, issue trackers, or agent prompts.

• Revoke keys when a person, machine, or integration no longer needs them.
• Use expiration dates for temporary integrations.
• Rotate credentials after suspected exposure.
• Review audit events after privileged changes.

Administrative safety

Administrative routes are not a substitute for organizational policy. Confirm the target organization, project, environment, and user before making a privileged change. Destructive or access-changing actions should be deliberate, auditable, and protected from changing the acting administrator’s own safety boundary.