MFA Settings
Demo only. Production must store hashed recovery codes and TOTP secrets server-side.
Production Controls
Rate limiting, secure cookies, CSRF protection, session revocation, login alerts, and hashed recovery codes are required before launch.