Supascale
Sign Up

Password Security

Password requirements, rate limiting, and account security in Supascale.

Supascale implements robust password security measures to protect your administrative account from unauthorized access.

Password Requirements

When setting or changing your password, it must meet all of the following criteria:

RequirementDescription
Minimum lengthAt least 12 characters
Uppercase letterAt least one uppercase letter (A-Z)
Lowercase letterAt least one lowercase letter (a-z)
NumberAt least one digit (0-9)
Special characterAt least one special character (!@#$%^&*()_+-=[]{};|,.<>/?)

Examples

Valid passwords:

  • MySecure@Pass123
  • Supascale#Admin2024!
  • Str0ng_P@ssword!

Invalid passwords:

  • password123 - No uppercase, no special character
  • SHORT!1a - Too short (less than 12 characters)
  • NoSpecialChar123 - No special character

Changing Your Password

  1. Go to Settings > Profile
  2. Click Change Password
  3. Enter your current password
  4. Enter and confirm your new password
  5. Click Save

Requirements:

  • Current password must be correct
  • New password must meet all requirements
  • New password must be different from current

Rate Limiting

Supascale protects against brute-force attacks with rate limiting:

Limits

SettingValue
Maximum failed attempts5
Initial lockout duration15 minutes
Attempt tracking window1 hour
Lockout escalationExponential backoff

How It Works

  1. Failed login attempts are tracked per IP address
  2. After 5 failed attempts, the account is temporarily locked
  3. Lockout duration doubles with each subsequent lockout
  4. Successful login resets the counter

If You're Locked Out

  1. Wait for the lockout period to expire
  2. Try logging in again with the correct password
  3. If you've forgotten your password, contact your system administrator

Session Security

Session Duration

  • Sessions are valid for 24 hours
  • After 24 hours, you'll need to log in again

Session Management

  • Sessions use secure, HTTP-only cookies
  • JWT tokens are signed with a secret key
  • Sessions are invalidated on logout

Best Practices

Creating Strong Passwords

  1. Use a password manager: Generate and store unique passwords
  2. Avoid personal information: Don't use names, birthdays, etc.
  3. Use passphrases: Combine random words with numbers and symbols
  4. Unique per service: Don't reuse passwords

Account Security

  1. Don't share credentials: Each admin should have their own account
  2. Log out when done: Especially on shared computers
  3. Monitor activity: Review login history regularly
  4. Update regularly: Change passwords periodically

Activity Logging

All authentication events are logged:

EventDescription
auth.login_successSuccessful login
auth.login_failedFailed login attempt
auth.login_blocked_rate_limitLogin blocked due to rate limiting
auth.password_changedPassword was changed

Viewing Login History

  1. Go to Settings > Activity
  2. Filter by authentication events
  3. Review login attempts and changes

Initial Setup Password

When first installing Supascale, set a strong password via environment variable:

ADMIN_PASSWORD=YourSecure@Password123

Important: Change this password immediately after first login.

Password Recovery

Supascale doesn't currently support self-service password recovery. If you've forgotten your password:

  1. Access the server directly
  2. Reset the password via environment variable
  3. Restart Supascale
  4. Log in with the new password
  5. Change the password through the UI

Security Recommendations

  1. Use unique passwords: Don't reuse your Supascale password elsewhere
  2. Enable HTTPS: Always access Supascale over HTTPS
  3. Limit network access: Restrict access to trusted IPs if possible
  4. Monitor logs: Watch for failed login attempts
  5. Keep updated: Install security updates promptly