Security
Settings → Security. Workspace-admin only, like the rest of this section. Two cards, both workspace-wide.
IP allowlist
Section titled “IP allowlist”A textarea, one IP address or CIDR range per line (203.0.113.0/24 and a
bare 198.51.100.7 both work). Leave it empty and every IP can reach the
workspace — that’s the default. Set anything and only clients inside one
of those ranges get through.
If you’re behind a reverse proxy, this only works right if the proxy is configured as trusted on the server side, so the real client IP gets checked instead of the proxy’s own address.
Login protection
Section titled “Login protection”A single toggle, Login CAPTCHA — on by default, which is why Getting started describes the math-CAPTCHA-after-several-failures behavior as just how sign-in works. It is configurable, though: after several failed sign-in attempts from the same IP, this is what requires solving a challenge before another attempt. Turn it off here if you’d rather not challenge repeat failures at all.