willchen96 bolts two-factor onto Mike and hands users the delete button

A single pass adds real account security and gives people genuine control over their own data.

willchen96 landed a broad security-and-privacy sweep. The headline is authenticator-app two-factor authentication, now required before any sensitive move - changing API keys, exporting data, bulk-deleting, or closing an account. A few pieces to know:

Optional two-factor at login, on top of the mandatory check for sensitive actions.
Signing out now ends only the current device's session instead of every session everywhere.
Users can export their chats, their tabular reviews, and a full copy of their account as a downloadable file.
Bulk deletion for chats, projects, and reviews, with project deletion now cleaning up every attached document, folder, and stored file instead of leaving debris behind.
Credentials and API keys are scrubbed from logs and error messages, closing a path that could have leaked keys; the account export deliberately carries key status but never the keys themselves.

Every export and delete route is locked behind authentication and rate limits.