Security

#Two-factor authentication

Protect your account with an authenticator app (Google Authenticator, 1Password, Aegis…):

1. Open Account → Two-factor authentication and start setup.
2. Scan the QR code and enter the 6-digit code to confirm.
3. Save the 10 backup codes. They're shown once. Each works one time if you lose your phone.

Once enabled, every sign-in (including through Discord or GitHub) asks for a code from your app. If you can't use the app, you can use a backup code or request a one-time code by email (valid 10 minutes).

#Sessions and alerts

• A sign-in stays valid for 30 days on that browser.
• Every sign-in from a new IP address sends you a "new login" email. If it wasn't you, secure your Discord or GitHub account and enable 2FA.

#How your code is built

Generated projects are code, and building them runs that code's build scripts. Codexe treats this as untrusted:

• Every build and load test runs in an isolated sandbox as its own unprivileged user, with a read-only system and no access to Codexe's servers, databases or other users' builds.
• The build can reach the internet only through a filter that allows the official dependency repositories (Maven Central, Paper, Spigot, Fabric, Forge, NeoForge, Mojang, Gradle, Modrinth and similar), over HTTPS.
• Each user's dependency cache is separate, so one project can't tamper with another's libraries.
• Datapack and Skript test servers run fully offline.

#Discord bot test runs

The bot token you paste into a project's Host panel is stored encrypted and can be deleted any time. Test-run bots run isolated, with internet access (they need Discord) but no access to Codexe's internal network. See Discord bots.

#Good practice

• Enable 2FA, on Codexe and on the Discord or GitHub account you sign in with.
• Never paste secrets (tokens, passwords, API keys) into a request or a public project. Generated code reads secrets from environment variables for that reason.
• Keep projects that contain anything sensitive private. See Sharing.