Sessions & Devices #

Sessions view provides a security-focused summary of authenticated access.

Current Behavior #

• Shows current local session metadata (device class + browser fingerprint label) from the active auth session.
• Supports global sign-out of other sessions via Supabase signOut({ scope: 'others' }).
• UI contains remote-session revoke controls, but current fetch flow populates only the local session row by default.

Visibility Caveat #

At this time, the screen should be treated as:

• authoritative for your current local session
• actionable for global remote-session purge
• not a guaranteed full remote-session inventory panel

Security Actions #

• PURGE_ALL_REMOTES to invalidate all non-local sessions.
• FORCE_GLOBAL_LOGOUT shortcut when no remotes are visible.

Recommendation #

Run a session purge when:

• password is changed
• Telegram link vector may have been exposed
• device compromise is suspected