Account security and recovery

Guest editing and export stay free. Signing in adds durable Turso revisions, private assets, cross-device access, profiles, community, and notifications.

Novus sends no email. Save the recovery codes shown at signup and add a passkey. Codes are hashed, single-use, and replaced as a complete set.

• Use a passkey or username plus an unused recovery code at `/recover`.
• Recovery creates a short-lived HttpOnly session and never returns a reset token in JSON.
• Without a passkey, recovery code, or authenticated trusted session, the account cannot be self-recovered.

Security settings list active devices without exposing session tokens. Admins use the normal account session; privileged changes require a fresh passkey and create an immutable audit record.