# Account security

> Two-factor authentication, passkeys and sessions.


- Turn on two-factor authentication with an authenticator app under **Settings → Security**. Save the recovery codes.
- Add a passkey to sign in without a password.
- See active sessions and sign out of the ones you do not recognize.
- CLI and extension logins appear under **Connections** and can be revoked there.

If you think a key leaked, revoke it under **API keys**. Revocation takes effect on the next request.

Report a vulnerability in NotHoly to the address in [security.txt](https://notholy.com/.well-known/security.txt).

## Next

- [Organizations and roles](/en/account/organizations)