Built with real account security
Security tools that don't practice what they preach are a liability. Every CyberSpec account — including yours — is protected the same way we'd expect any security-conscious team to protect theirs.
Two-factor authentication, offered up front
Every account is walked through TOTP setup at first sign-in, on every sign-in method — password, Google, or GitHub. Skip it if you must; turn it on any time from Settings.
Google & GitHub sign-in
OAuth logins trust the provider's own verified-email claim and go through the same MFA setup step as email/password accounts.
Backup codes for account recovery
Ten single-use backup codes are generated at MFA enrollment, so losing your authenticator app never locks you out permanently.
Session control
See every active session across your devices and remote-sign-out any of them, right from Settings.
MFA is the default path, not a buried setting
Most tools hide two-factor three menus deep, then report an adoption percentage. CyberSpec puts TOTP setup directly after your first sign-in, on every sign-in method — email and password, Google, and GitHub alike. A solo operator who genuinely does not need it can skip it with one click and turn it on later from Settings → Security; the skip is recorded in the account audit log, never silent. CyberSpec’s own platform-admin accounts cannot skip it at all.
OAuth logins are held to the same bar
Signing in with Google or GitHub trusts the provider's own verified-email claim rather than sending a second verification mail, and after that they get the identical MFA setup step as email and password accounts. You can also link a second provider to an existing account, so losing access to one identity provider does not lose you the account.
Losing your phone is not losing your account
Ten single-use backup codes are generated at MFA enrolment. If the authenticator app is gone, a backup code gets you in; if the codes are gone too, recovery runs through email verification. Both paths are recorded in the account audit log, so an unexpected recovery is visible after the fact rather than silent.
You can see and end every session
Settings lists every active session across your devices with the ability to sign any of them out remotely. Organisation accounts add role-based access — Owner, Admin, Analyst, Viewer — enforced server-side on every action through a central permission matrix rather than ad-hoc checks scattered across routes, so a Viewer cannot reach an action simply because a page forgot to hide the button.
Enterprise SSO without dropping the floor
Enterprise organisations can point CyberSpec at their own SAML or OIDC identity provider — Okta, Azure AD, and the like. MFA still applies on top unless the customer's own IdP already enforces it organisation-wide. That trade-off is documented rather than silently made, because "we turned MFA off for the SSO tenant" is exactly the sort of thing that should never be a surprise.
Your data stays exportable and deletable
Every account can export its data as JSON and request account deletion from the privacy settings, without opening a support ticket. API keys are scoped to a single organisation and can be revoked instantly. The point of all of it is the same: a security vendor that makes leaving hard has an odd definition of trust.
Reporting a vulnerability in CyberSpec itself? Contact details and our PGP key are published at /.well-known/security.txt per RFC 9116. For how findings map to audit controls, see SOC 2, ISO 27001 and PCI DSS coverage.