Two-factor authentication (TOTP)
Add a second factor: your password plus a 6-digit code from an authenticator app (Aegis, 1Password, Google Authenticator…). Recovery codes cover a lost phone. Your LLM API key lives in Settings — worth a second lock on the account that can read it.
Backups
Everything you own, in one click. The JSON export covers every table — menus, every extracted item and your settings (SMTP password, LLM API key, webhook URLs and every other credential-named setting redacted); the database file is the rawest possible backup on SQLite installs.