Blog

MFA and security from day one

DiagramaHub 0.2.0 and 0.2.1 bring MFA via email and TOTP apps, recovery codes, stronger passwords, a security audit log and platform hardening.

Your diagrams describe how your system is built: which services exist, how they authenticate, where each piece of data lives. That's not something you want in the wrong hands. So just days after launching DiagramaHub, we spent two full releases, 0.2.0 and 0.2.1, hardening account and platform security.

Multi-factor authentication

The headline is MFA, with two methods you can enable at the same time:

  • Email: we send a code to your inbox, in Spanish or English depending on your account language.
  • TOTP app: Google Authenticator, Authy or any compatible app.

With both enabled, you pick a default, and at login you can hit "Try another method" to switch. You also get 8 single-use recovery codes (XXXXX-XXXXX format) for when your main method isn't at hand.

sequenceDiagram
    participant U as You
    participant D as DiagramaHub
    U->>D: Email and password
    D->>U: Asks for second factor
    U->>D: TOTP, email or recovery code
    D->>U: 5-day session

Everything lives under Security in your profile: turn methods on or off, change the default and regenerate codes. If you don't have MFA yet, you'll see a low-key banner after signing in recommending it.

We also changed session length: 2 days without MFA, 5 days with it. Protecting your account means signing in less often, too.

Stronger passwords

The password policy went from 8 to a 12-character minimum, with at least one uppercase letter, one lowercase letter, one digit and one special character, and it can't match your email. Sign-up, change and reset forms now show a real-time strength meter.

In 0.2.1 we added something important: changing your password invalidates every session issued before the change. If you suspect someone got into your account, changing it is enough to kick them out.

Security audit log

0.2.1 introduces an audit log of security events: successful and failed logins, account lockouts, MFA verifications, password changes and resets, recovery code usage and admin MFA resets. Entries are kept for 90 days and then removed automatically.

For instance admins

If you self-host DiagramaHub, there's a new user admin panel: a paginated, searchable list with MFA status, subscription plan, sign-up date and, since 0.2.1, each user's diagram count. You can export it to Excel (.xlsx) and disable MFA for a user who got locked out.

Platform hardening

On the server side we closed a few doors too:

  • Login rate limiting: at most 10 attempts per IP per minute.
  • Temporary lockout for 15 minutes after 5 consecutive failed attempts.
  • HTTP security headers (including HSTS in production).
  • In production, Swagger/OpenAPI docs are disabled and 500 errors no longer leak stack traces.

0.2.1 also polishes the MFA flow: the banner no longer shows up after you enable MFA, "Try another method" now shows a selection screen instead of sending an email right away, and unused recovery codes are no longer regenerated when you add a second method.

Turn on MFA

Head to DiagramaHub Cloud, open your profile → Security and enable at least one method. Self-hosting? Update from the repository; every change is listed in the changelog.