# Account sign-in and security

> Sign-in methods, what we record about your sessions, how lockout works, and what to do if you can't get in.

Source: https://hyperjobs.io/help/account-security

Accounts are for developers using the API. There are no candidate accounts, no
CVs, and nothing to apply to — see [what HyperJobs is](/docs).

## Signing in

Two methods, both through Firebase Authentication:

- **Email and password**
- **Google sign-in**

Use whichever you registered with. If you signed up with Google, there's no
password on the account to reset — sign in with Google.

Password resets go to the address on the account, from the sign-in page. If the
email doesn't arrive, check spam before writing to us; we can't read the reset
link out to you.

<Note>
  Disposable-email domains are rejected at signup, and there are limits on how
  many accounts one IP can create — **3 per hour** and **10 per 30 days**. These
  exist to stop bulk account farming. Shared office and campus IPs are the reason
  the 30-day number is generous rather than tight, but if you're legitimately
  blocked by it, write to <Email kind="support" />.
</Note>

## Account lockout

Repeated failed sign-ins lock the account, progressively:

| Failed attempts | Locked for |
| --- | --- |
| 5 | 15 minutes |
| 10 | 1 hour |
| 20 | 24 hours |

Lockout is keyed to the account, and it's time-based — it clears on its own. There
is nothing to unlock and no one to ask; wait it out. If you've forgotten the
password, reset it rather than burning attempts.

<Warning title="Lockout doesn't touch your API keys">
  Being locked out of the dashboard has no effect on your API keys. They keep
  serving requests throughout — key auth and account sign-in are separate systems.
  A lockout is not an outage.
</Warning>

## Sessions

We record a session when you sign in, and show it on your account so you can see
where you're signed in. Each session carries:

- **Browser** and **operating system**
- **IP address**
- **Coarse location** — city, region, country, derived from the IP

That's device-level detail, not tracking. It's there so an unfamiliar entry is
visible to you, which is the only reliable way you'd notice someone else in your
account.

Sign-in and account events are also written to an append-only audit log, retained
for **365 days**. [The privacy policy](/legal/privacy) has the full table of what
we collect and how long we keep it — including the device fingerprint and signup
IP, which exist for abuse prevention and are documented rather than hidden.

## If you think someone's in your account

<Steps>
  <Step title="Change your password">
    Or, on a Google account, secure the Google account — that's the credential.
  </Step>
  <Step title="Check your sessions">
    An IP or city you don't recognise is the signal.
  </Step>
  <Step title="Revoke every API key you don't recognise">
    Keys are the part with commercial consequences: they spend your quota. See
    [if a key leaks](/help/key-security).
  </Step>
  <Step title="Check your usage">
    The [dashboard](/dashboard) shows a 30-day daily breakdown per key. Volume you
    can't account for is what a stolen key looks like.
  </Step>
</Steps>

Then tell us at <Email kind="security" />.

## What an attacker could actually do

Worth being precise, because it's narrower than you might assume. The API is
read-only: there are no `POST`, `PUT` or `DELETE` routes. Someone with your key
can read job data and spend your quota. They cannot modify your data, and they
cannot reach your billing — card details live with Stripe and we never hold them.

Someone with your *account* password is a bigger problem: they could create keys
and open the Stripe portal. That's why the password matters more than the key
does.

## Reporting a vulnerability

Write to <Email kind="security" />. Security testing against the API requires
written permission in advance — see [§7 of the terms](/legal/terms) — and please
give us reasonable time to fix an issue before disclosing it.

## Next

<CardGroup cols={2}>
  <Card title="If a key leaks" icon="KeyRound" href="/help/key-security">
    Rotation without downtime.
  </Card>
  <Card title="Deleting your account" icon="Trash2" href="/help/delete-account">
    What deletion does, and what survives it.
  </Card>
</CardGroup>