Security·June 28, 2026·1 min read
🔐 Your account, better guarded
Shipping fast and friendly — here's what's new: auth to email magic code (6-digit otp).
What's new
- magic_tokens gains code + attempts columns
- requestMagicCode (send 6-digit code, invalidate prior codes) + verifyMagicCode
- Two-step login UI: email -> code, with resend + dev-code display
- sendMagicCode email (Resend in prod, on-screen code in dev)
- Remove old /auth/verify magic-link route
- Free open signup: first email entry creates the account; tag claiming stays
Why it matters
Account security is foundational. Every improvement here keeps your belongings — and the people trying to return them — protected by default.