+5 -4

docs/account-security.md

Reviewed

··· 35 35 the app-password name. Revoking an app password deletes the credential and 36 36 revokes active sessions that were created with it. 37 37 38 38 - Privileged app passwords are for clients that need the privileged app-password 39 39 - scope. ZDS currently stores privileged app passwords with `transition:generic` 40 40 - and `transition:chat.bsky`; ordinary app passwords store only 41 41 - `transition:generic`. 38 38 + Privileged app passwords are for trusted clients that need the official 39 39 + privileged app-password scope and access to sensitive account features. In the 40 40 + current Bluesky-compatible ecosystem, that also includes chat transition access: 41 41 + ZDS stores privileged app passwords with `transition:generic` and 42 42 + `transition:chat.bsky`; ordinary app passwords store only `transition:generic`. 42 43 43 44 ## management UI 44 45

+1 -1

src/internal/passkeys.zig

Reviewed

··· 131 131 \\<label for="app-password-name">new app password name</label> 132 132 \\<input id="app-password-name" name="appPasswordName" placeholder="client or device name"> 133 133 \\<label class="checkbox"><input id="app-password-privileged" type="checkbox"> privileged app password</label> 134 134 - \\<p class="field-help">Use only for clients that need the official privileged app-password scope, including chat transition access. Most clients should leave this off.</p> 134 134 + \\<p class="field-help">Trusted clients only. Privileged app passwords can access sensitive account features; in Bluesky-compatible clients this includes chat transition APIs. Most clients should leave this off.</p> 135 135 \\<button id="create-app-password" type="button">create app password</button> 136 136 \\<div id="generated-app-password" class="generated" aria-live="polite"></div> 137 137 \\</section>