Levlix Security Update: Two-Factor Authentication for the Dashboard
Today we are rolling out the most significant security upgrade to the Levlix Dashboard since its launch. Starting with version 8.5.0 through 8.7.6, the dashboard now enforces two-factor authentication, encrypted secret storage, brute-force protection, and shorter session lifetimes.
These changes protect your server configuration from unauthorized access, even if a Discord account is compromised.
What Changed
Two-Factor Authentication (TOTP)
Team members with elevated permissions are now required to set up TOTP-based two-factor authentication on the Levlix Dashboard. This is the same standard used by banks, cloud providers, and every serious platform in 2026.
The setup process:
- Log in with your Discord account as usual
- A QR code appears on screen
- Scan it with any authenticator app (Google Authenticator, Authy, Microsoft Authenticator, or any TOTP-compatible app)
- Enter the 6-digit code to verify
- Done. Future logins require both Discord and your authenticator
A manual entry code is also provided for cases where QR scanning is not possible.
This is in addition to Discord's native MFA. Team members must have both Discord 2FA and Levlix Dashboard 2FA enabled. Two layers. Two different systems. One compromised account is not enough.
Encrypted Secret Storage
Your TOTP secrets are encrypted before they touch the database. We use Fernet symmetric encryption, the same standard used across the industry for secrets management. The encryption key is stored separately from the database, so a database breach alone cannot expose your 2FA secrets.
This was shipped in v8.6.0 alongside the expanded storage format needed for encrypted data.
Brute-Force Protection
Guessing a 6-digit TOTP code is statistically unlikely. Making it impossible is better.
After 5 failed verification attempts, the account is locked out of 2FA verification for 15 minutes. The counter resets on successful verification. This rate limiting is enforced server-side through Redis, making it immune to client-side manipulation.
The math: TOTP codes expire every 30 seconds. By the time the 15-minute lockout ends, the codes that were attempted are long gone. Rate limiting combined with expiring codes makes brute force essentially impossible in practice, not just slow.
Shorter Session Lifetimes
Dashboard sessions now expire after 8 hours by default, reduced from the previous 24-hour window. Sessions are stored server-side in Redis, not in browser cookies. This means:
- Closing your browser does not extend your session
- Sessions cannot be forged or modified client-side
- Expired sessions require full re-authentication, including 2FA
What This Means for You
If You Are a Levlix Team Member
The next time you log into the Levlix Dashboard, you will be prompted to:
- Enable Discord's built-in two-factor authentication (if not already active)
- Set up TOTP for the Levlix Dashboard
This is a one-time setup. After that, logins require your authenticator app code in addition to your Discord account. Plan for an extra 10 seconds per login.
If You Are a Regular Member
Nothing changes for you. These security requirements apply only to Levlix staff roles (translators, moderators, administrators, developers, owner). Server owners and regular members continue to log in with Discord OAuth as before.
Version Timeline
| Version | Change |
|---|---|
| v8.5.0 | Dual 2FA enforcement: Discord MFA + Dashboard TOTP |
| v8.6.0 | TOTP rate limiting and database encryption at rest |
| v8.6.1-8.6.4 | QR code UI refinements and encryption column updates |
| v8.7.0 | Session lifetime reduced to 8 hours |
| v8.7.1-8.7.2 | Discord MFA enforcement refinements |
| v8.7.6 | Release that consolidated all of the above |
Why This Matters
Discord bots manage server permissions, moderation actions, economy systems, and member data. A compromised dashboard session could let an attacker modify server settings, ban members, or access sensitive configuration.
Two-factor authentication is the industry standard for preventing unauthorized access. By requiring it for all elevated users, we ensure that even if a Discord account is phished or compromised, the attacker cannot access your Levlix Dashboard without physical access to your authenticator device.
Security is not a feature you notice when it works. It is a feature you notice when it is missing.
Read the Web Dashboard Guide for more information about dashboard security and access controls.
Your Levlix Team