Auth

URL: /dashboard/settings/auth

Sign-in rules for this install. Ability: settings.revise.

Setting	Effect
Require email verification	New accounts must verify before they continue
Password minimum	8–72 characters
Mixed case / numbers / symbols	Extra password rules
Uncompromised passwords	Rejects passwords found in breach lists
Hash driver	`bcrypt` or `argon2id` when the server supports it
Bcrypt rounds	8–12
Password reset expiry	Minutes the reset link stays valid (15–1440)
Login attempts	Failures allowed before lockout (3–20)
Decay	Minutes until the lockout clears (1–60)

Google and GitHub sign-in are separate OAuth clients under API Integration. Captcha on the auth forms is Captcha.