Two-factor authentication — expanded methods

SMS 2FA is fine, but it isn’t great — SIM-swap attacks against contractor accounts have become common enough that we’d been recommending TOTP off-band for the last six months. This release moves TOTP into the native settings UI: scan the QR code with Google Authenticator, 1Password, Authy, or any other RFC 6238 compatible app, and you’re done.

Admins on the Security settings page now see a "Require 2FA for all users" toggle. Flipping it gives existing users a 7-day grace window to enroll, after which non-enrolled accounts are locked out of new sessions until they enroll. SMS-only accounts continue to work but are flagged with a yellow chip in the user table so admins can nudge upgrades.