Skip to main content

max / makenotwork

docs: resolve moderation and security slug collisions guide/moderation.md and legal/moderation.md both slugified to /docs/moderation (Legal won; the guide "Forum moderation policy" was unreachable), and guide/security.md and tech/security.md both to /docs/security (Tech won; the "Account Security" guide unreachable). Rename the two guide pages to forum-moderation and account-security so each slug is distinct, keeping the canonical slugs on the authoritative legal/tech pages. Repoint the three guide links that intended the account-security page but silently mis-resolved to tech/security. Surfaced by MNW_CHECK_DOCS. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-23 15:40 UTC
Commit: e494879eace6e91ca6226faad6afbdcfc20dc625
Parent: 575b271
6 files changed, +163 insertions, -163 deletions
A server/site-docs/public/guide/account-security.md +94
@@ -0,0 +1,94 @@
1 + # Account Security
2 +
3 + Makenot.work supports two-factor authentication (2FA) to protect your account. You can use passkeys, a TOTP authenticator app, or both.
4 +
5 + ## Passkeys
6 +
7 + Passkeys use WebAuthn to let you log in with a fingerprint, face scan, hardware key, or device PIN -- no password needed.
8 +
9 + ### Setting Up a Passkey
10 +
11 + 1. Go to Settings > Security
12 + 2. Click "Add Passkey"
13 + 3. Follow your browser/device prompt to create the credential
14 + 4. Give it a name (e.g., "MacBook Touch ID", "YubiKey")
15 +
16 + You can register up to 20 passkeys per account.
17 +
18 + ### Logging In with a Passkey
19 +
20 + On the login page, click "Use Passkey" instead of entering your password. Passkey login is inherently two-factor (identity + device possession), so no TOTP code is required.
21 +
22 + ### Managing Passkeys
23 +
24 + From Settings > Security you can:
25 +
26 + - **List** all registered passkeys with their creation dates
27 + - **Rename** a passkey for easier identification
28 + - **Delete** a passkey (requires password confirmation)
29 +
30 + If you lose access to all your passkeys, you can still log in with your password (plus TOTP if enabled).
31 +
32 + ## TOTP Authenticator App
33 +
34 + TOTP adds a six-digit rotating code from an authenticator app as a second factor after your password.
35 +
36 + ### Setting Up TOTP
37 +
38 + 1. Go to Settings > Security
39 + 2. Click "Enable Authenticator App"
40 + 3. Scan the QR code with your authenticator app (or enter the secret manually)
41 + 4. Enter the six-digit code from your app to confirm setup
42 + 5. Save your backup codes immediately
43 +
44 + Compatible apps include 1Password, Bitwarden, Authy, Google Authenticator, and any TOTP-compliant app (RFC 6238, SHA-1, 6 digits, 30-second interval).
45 +
46 + ### Logging In with TOTP
47 +
48 + 1. Enter your email and password as usual
49 + 2. When prompted, enter the current six-digit code from your authenticator app
50 +
51 + If you registered a passkey, passkey login bypasses the TOTP step entirely.
52 +
53 + ### Disabling TOTP
54 +
55 + Go to Settings > Security and click "Disable Authenticator App." You will need to confirm your password.
56 +
57 + ## Backup Codes
58 +
59 + When you enable TOTP, you receive 10 single-use backup codes (8 characters each) usable in place of a TOTP code.
60 +
61 + **Store backup codes securely.** If you lose access to your authenticator app and have no backup codes, recovery requires emailing info@makenot.work.
62 +
63 + ### Regenerating Backup Codes
64 +
65 + Go to Settings > Security > "Regenerate Backup Codes." This invalidates all previous codes and generates a fresh set of 10. You must confirm your password.
66 +
67 + ## Login Notifications
68 +
69 + If a new login occurs while you have other active sessions, you receive an email notification automatically.
70 +
71 + ## Password Policy
72 +
73 + - Minimum 8 characters, maximum 128
74 + - No character type requirements
75 + - Checked against HaveIBeenPwned breach databases (k-anonymity; your password is never sent externally). Breached passwords trigger an advisory warning but are not blocked.
76 +
77 + ## Account Lockout
78 +
79 + After 5 consecutive failed password attempts, your account is locked for 15 minutes. Passkey authentication is not affected by password lockout.
80 +
81 + See [Password Reset](./password-reset.md) for recovery options.
82 +
83 + ## Recommendations
84 +
85 + - Enable at least one 2FA method (passkeys are the strongest option)
86 + - Register multiple passkeys on different devices so you are never locked out
87 + - If using TOTP, save your backup codes in a password manager or printed in a secure location
88 + - Use a unique, strong password even if you primarily log in with passkeys
89 +
90 + ## See Also
91 +
92 + - [Getting Started](./getting-started.md): Account creation and initial setup
93 + - [Password Reset](./password-reset.md): Forgot password and lockout recovery
94 + - [Profile](./profile.md): Editing your public profile
A server/site-docs/public/guide/forum-moderation.md +66
@@ -0,0 +1,66 @@
1 + # Forum moderation policy
2 +
3 + How MNW handles communities that drift into neglect or hostility. This is the public version of the policy; the working internal version lives in the Multithreaded source tree.
4 +
5 + ## Principle
6 +
7 + MNW communities are creator-moderated. We are not the content police. But we do enforce a quality floor: communities that stop being maintained will be addressed, because neglected spaces harm fans and reflect on the platform.
8 +
9 + The goal is always to give the creator a real path forward, not to punish.
10 +
11 + ## State ladder
12 +
13 + Every community sits in one of four states. State changes are reversible: a community can move freely between them. The audit log records every transition with the actor and timestamp.
14 +
15 + ### Active
16 +
17 + The default. Members can start threads, reply, and use forum features as their Fan+ status allows.
18 +
19 + ### Restricted
20 +
21 + New thread creation is disabled for non-moderator accounts. Existing threads still accept replies. Mods and platform admin keep full access.
22 +
23 + Typical trigger: unresolved flags older than ~14 days, or a pattern of reports going unaddressed.
24 +
25 + ### Frozen
26 +
27 + Read-only for everyone except moderators performing moderation actions. Members cannot post, reply, footnote, or endorse. Mods can clear the backlog, ban bad actors, and remove posts. Once the queue is addressed, they unfreeze.
28 +
29 + Typical trigger: continued inaction after a Restricted period.
30 +
31 + ### Archived
32 +
33 + Behaves like Frozen and is hidden from the default forum directory. Still reachable by direct URL. Surfaces under the explicit "View archived" filter.
34 +
35 + Reactivation is just a state change back to Active.
36 +
37 + ## Clean slate
38 +
39 + A creator (or platform admin acting on the creator's behalf) can request a clean slate: every thread, post, footnote, endorsement, and flag is deleted. The community row, categories, settings, members, bans, and mutes are preserved.
40 +
41 + After the wipe, a single pinned, locked notice is posted in the first category recording who reset the forum and when. No explanation. No blame. No platform statement.
42 +
43 + The clean slate is irreversible at the data level, so the admin UI requires typing the community slug to confirm, the same pattern GitHub uses for repository deletion.
44 +
45 + The creator's account, project, tier, payment history, and fan relationships are untouched by a clean slate.
46 +
47 + ## What MNW never does
48 +
49 + - Public announcement explaining why a community was reset or moved between states.
50 + - Marking the creator's profile, project page, or storefront with the moderation history.
51 + - Discussing the situation with other creators or fans.
52 + - Using forum moderation history as a factor in unrelated account decisions.
53 + - Naming or shaming in any context.
54 +
55 + ## Authorization
56 +
57 + State changes and clean slates require either:
58 +
59 + - A community **Owner** or **Moderator** acting within that community, or
60 + - The **platform admin** acting from the dedicated admin view.
61 +
62 + A per-permission system is on the roadmap; for now, this two-layer model is what the Multithreaded forum software enforces.
63 +
64 + ## Reporting a problem
65 +
66 + If you encounter content or behavior that violates a community's rules, use the flag button on the post. Flags route to that community's moderators first. If the community's mods are non-responsive, MNW staff review unresolved flags as part of platform-level monitoring.
M server/site-docs/public/guide/getting-started.md +1 -1
@@ -168,7 +168,7 @@ You can start shared and transition later: create individual accounts, add them
168 168 After your first publish:
169 169
170 170 1. **Fill out your profile.** Bio, avatar, header image, links. See [Profile](./profile.md).
171 - 2. **Set up security.** Enable two-factor authentication and save your backup codes. See [Security](./security.md).
171 + 2. **Set up security.** Enable two-factor authentication and save your backup codes. See [Account Security](./account-security.md).
172 172 3. **Share your link.** Post your profile URL, project URL, or direct purchase link (`/buy/{item_id}`) wherever your audience is. Purchase links are minimal pages optimized for social media and link-in-bio; fans buy in one step without an account. You can also [point your own domain](./custom-domains.md) at your profile.
173 173 4. **Set up RSS cross-posting.** Connect your RSS feed to social media or newsletter tools. See [RSS](./rss.md).
174 174 5. **Fill in metadata.** Good titles, descriptions, tags, and cover art make your content discoverable. See [Metadata](./metadata.md). Per-file size limits depend on your [tier](./tiers.md).
D server/site-docs/public/guide/moderation.md -66
@@ -1,66 +0,0 @@
1 - # Forum moderation policy
2 -
3 - How MNW handles communities that drift into neglect or hostility. This is the public version of the policy; the working internal version lives in the Multithreaded source tree.
4 -
5 - ## Principle
6 -
7 - MNW communities are creator-moderated. We are not the content police. But we do enforce a quality floor: communities that stop being maintained will be addressed, because neglected spaces harm fans and reflect on the platform.
8 -
9 - The goal is always to give the creator a real path forward, not to punish.
10 -
11 - ## State ladder
12 -
13 - Every community sits in one of four states. State changes are reversible: a community can move freely between them. The audit log records every transition with the actor and timestamp.
14 -
15 - ### Active
16 -
17 - The default. Members can start threads, reply, and use forum features as their Fan+ status allows.
18 -
19 - ### Restricted
20 -
21 - New thread creation is disabled for non-moderator accounts. Existing threads still accept replies. Mods and platform admin keep full access.
22 -
23 - Typical trigger: unresolved flags older than ~14 days, or a pattern of reports going unaddressed.
24 -
25 - ### Frozen
26 -
27 - Read-only for everyone except moderators performing moderation actions. Members cannot post, reply, footnote, or endorse. Mods can clear the backlog, ban bad actors, and remove posts. Once the queue is addressed, they unfreeze.
28 -
29 - Typical trigger: continued inaction after a Restricted period.
30 -
31 - ### Archived
32 -
33 - Behaves like Frozen and is hidden from the default forum directory. Still reachable by direct URL. Surfaces under the explicit "View archived" filter.
34 -
35 - Reactivation is just a state change back to Active.
36 -
37 - ## Clean slate
38 -
39 - A creator (or platform admin acting on the creator's behalf) can request a clean slate: every thread, post, footnote, endorsement, and flag is deleted. The community row, categories, settings, members, bans, and mutes are preserved.
40 -
41 - After the wipe, a single pinned, locked notice is posted in the first category recording who reset the forum and when. No explanation. No blame. No platform statement.
42 -
43 - The clean slate is irreversible at the data level, so the admin UI requires typing the community slug to confirm, the same pattern GitHub uses for repository deletion.
44 -
45 - The creator's account, project, tier, payment history, and fan relationships are untouched by a clean slate.
46 -
47 - ## What MNW never does
48 -
49 - - Public announcement explaining why a community was reset or moved between states.
50 - - Marking the creator's profile, project page, or storefront with the moderation history.
51 - - Discussing the situation with other creators or fans.
52 - - Using forum moderation history as a factor in unrelated account decisions.
53 - - Naming or shaming in any context.
54 -
55 - ## Authorization
56 -
57 - State changes and clean slates require either:
58 -
59 - - A community **Owner** or **Moderator** acting within that community, or
60 - - The **platform admin** acting from the dedicated admin view.
61 -
62 - A per-permission system is on the roadmap; for now, this two-layer model is what the Multithreaded forum software enforces.
63 -
64 - ## Reporting a problem
65 -
66 - If you encounter content or behavior that violates a community's rules, use the flag button on the post. Flags route to that community's moderators first. If the community's mods are non-responsive, MNW staff review unresolved flags as part of platform-level monitoring.
M server/site-docs/public/guide/password-reset.md +2 -2
@@ -42,9 +42,9 @@ If you know your current password and want to change it:
42 42
43 43 After 5 consecutive failed login attempts, your account is locked for 15 minutes. A one-time login link is emailed to you automatically. Click the link to bypass the lockout and log in. Passkey login is not affected by password lockout.
44 44
45 - For full details on 2FA, passkeys, and session management, see [Account Security](./security.md).
45 + For full details on 2FA, passkeys, and session management, see [Account Security](./account-security.md).
46 46
47 47 ## See Also
48 48
49 - - [Account Security](./security.md): 2FA, passkeys, and session management
49 + - [Account Security](./account-security.md): 2FA, passkeys, and session management
50 50 - [Getting Started](./getting-started.md): Account creation
D server/site-docs/public/guide/security.md -94
@@ -1,94 +0,0 @@
1 - # Account Security
2 -
3 - Makenot.work supports two-factor authentication (2FA) to protect your account. You can use passkeys, a TOTP authenticator app, or both.
4 -
5 - ## Passkeys
6 -
7 - Passkeys use WebAuthn to let you log in with a fingerprint, face scan, hardware key, or device PIN -- no password needed.
8 -
9 - ### Setting Up a Passkey
10 -
11 - 1. Go to Settings > Security
12 - 2. Click "Add Passkey"
13 - 3. Follow your browser/device prompt to create the credential
14 - 4. Give it a name (e.g., "MacBook Touch ID", "YubiKey")
15 -
16 - You can register up to 20 passkeys per account.
17 -
18 - ### Logging In with a Passkey
19 -
20 - On the login page, click "Use Passkey" instead of entering your password. Passkey login is inherently two-factor (identity + device possession), so no TOTP code is required.
21 -
22 - ### Managing Passkeys
23 -
24 - From Settings > Security you can:
25 -
26 - - **List** all registered passkeys with their creation dates
27 - - **Rename** a passkey for easier identification
28 - - **Delete** a passkey (requires password confirmation)
29 -
30 - If you lose access to all your passkeys, you can still log in with your password (plus TOTP if enabled).
31 -
32 - ## TOTP Authenticator App
33 -
34 - TOTP adds a six-digit rotating code from an authenticator app as a second factor after your password.
35 -
36 - ### Setting Up TOTP
37 -
38 - 1. Go to Settings > Security
39 - 2. Click "Enable Authenticator App"
40 - 3. Scan the QR code with your authenticator app (or enter the secret manually)
41 - 4. Enter the six-digit code from your app to confirm setup
42 - 5. Save your backup codes immediately
43 -
44 - Compatible apps include 1Password, Bitwarden, Authy, Google Authenticator, and any TOTP-compliant app (RFC 6238, SHA-1, 6 digits, 30-second interval).
45 -
46 - ### Logging In with TOTP
47 -
48 - 1. Enter your email and password as usual
49 - 2. When prompted, enter the current six-digit code from your authenticator app
50 -
51 - If you registered a passkey, passkey login bypasses the TOTP step entirely.
52 -
53 - ### Disabling TOTP
54 -
55 - Go to Settings > Security and click "Disable Authenticator App." You will need to confirm your password.
56 -
57 - ## Backup Codes
58 -
59 - When you enable TOTP, you receive 10 single-use backup codes (8 characters each) usable in place of a TOTP code.
60 -
61 - **Store backup codes securely.** If you lose access to your authenticator app and have no backup codes, recovery requires emailing info@makenot.work.
62 -
63 - ### Regenerating Backup Codes
64 -
65 - Go to Settings > Security > "Regenerate Backup Codes." This invalidates all previous codes and generates a fresh set of 10. You must confirm your password.
66 -
67 - ## Login Notifications
68 -
69 - If a new login occurs while you have other active sessions, you receive an email notification automatically.
70 -
71 - ## Password Policy
72 -
73 - - Minimum 8 characters, maximum 128
74 - - No character type requirements
75 - - Checked against HaveIBeenPwned breach databases (k-anonymity; your password is never sent externally). Breached passwords trigger an advisory warning but are not blocked.
76 -
77 - ## Account Lockout
78 -
79 - After 5 consecutive failed password attempts, your account is locked for 15 minutes. Passkey authentication is not affected by password lockout.
80 -
81 - See [Password Reset](./password-reset.md) for recovery options.
82 -
83 - ## Recommendations
84 -
85 - - Enable at least one 2FA method (passkeys are the strongest option)
86 - - Register multiple passkeys on different devices so you are never locked out
87 - - If using TOTP, save your backup codes in a password manager or printed in a secure location
88 - - Use a unique, strong password even if you primarily log in with passkeys
89 -
90 - ## See Also
91 -
92 - - [Getting Started](./getting-started.md): Account creation and initial setup
93 - - [Password Reset](./password-reset.md): Forgot password and lockout recovery
94 - - [Profile](./profile.md): Editing your public profile