Account & Team

Profile

Settings → Profile covers the three things tied to you personally, separate from anything organization-wide:

• Name — updates immediately.
• Email — requires reconfirmation: a verification link goes to the new address, and a heads-up notice goes to the old one, so an account can't be quietly redirected to an inbox you don't control. The address only actually changes once the new one is confirmed.
• Password — changing it keeps your current session signed in but revokes every other active session, the same as if you'd suspected a compromise.

Sessions

Settings → Sessions lists every device/browser currently signed in — user agent, IP address, and when it signed in — with a Revoke button per session. Useful after a password change you didn't trigger, or just to sign out an old laptop you no longer have.

Team

Settings → Teams — invite teammates by email; each invite shows as pending until accepted. Two roles:

Role	Can
Owner	Everything a member can, plus: manage billing, connect/disconnect Git providers, enable/disconnect/delete individual repositories, set the BYOK AI key, manage API keys, invite/remove members, delete organization data
Member	View everything; trigger rescans, change a finding's status, generate fix PRs

Accepting an invite creates the teammate's own login (name + password) — there's no shared account. They also explicitly confirm they're authorized to submit repositories for scanning as part of accepting, since that decision (whose code goes to a third-party AI provider) shouldn't be implicit.

Removing a member revokes their access immediately; it doesn't touch anything they've already done (findings they marked, fix PRs they generated stay as-is).