--- title: "Account Management, Log Streams & more | Phase Changelog" description: "Security fixes for the GitHub integration, a new Account page with 2FA and sign-in methods, audit log streaming to Datadog, a mobile-friendly Console, and more." url: https://phase.dev/changelog/account-management-log-streams/ --- [Changelog](https://phase.dev/changelog/) 2026.09.01 # Account Management, Log Streams & more Security fixes for the GitHub integration, a new Account page with 2FA and sign-in methods, audit log streaming to Datadog, a mobile-friendly Console, and more. [security](https://phase.dev/changelog/tag/security/)[console](https://phase.dev/changelog/tag/console/)[cli](https://phase.dev/changelog/tag/cli/)[authentication](https://phase.dev/changelog/tag/authentication/)[logs](https://phase.dev/changelog/tag/logs/)[kubernetes](https://phase.dev/changelog/tag/kubernetes/)[self-hosting](https://phase.dev/changelog/tag/self-hosting/) This update gives your Phase account a home of its own, with two-factor authentication, multiple sign-in methods, and self-service email changes. It also brings Log Streams for shipping audit logs to Datadog, a mobile-friendly Console, a secrets Filter menu with GitHub-style search qualifiers, an AI deployment skill for Azure AKS, published egress IPs for Phase Cloud, and a round of CLI fixes. * * * ## Account Management & Two-Factor Authentication Your Phase account now has a home. The new **Account page** brings together your profile, email address, sign-in methods, and two-factor authentication in one place. Open it from the user menu in the top right corner of the Console. ![The Account page](https://phase.dev/assets/images/changelog/account-management-log-streams/account-page.png) - **Multiple sign-in methods.** Link Google, GitHub, GitLab, Microsoft Entra ID, Okta, or your organisation's SSO provider to one account, alongside a password. Sign in with any of them. - **Two-factor authentication.** Protect Console sign-in with a TOTP code from any authenticator app. 2FA applies to every sign-in method on your account, including SSO. - **Profile updates.** Update your display name and your account email address. - **Account deletion.** Permanently delete your account and all associated data. Sensitive changes are protected by re-authentication. If your last sign-in is older than 15 minutes, Phase asks you to confirm it's you before the change starts, then returns you to exactly where you left off. ![2FA setup: confirm with a 6-digit code](https://phase.dev/assets/images/changelog/account-management-log-streams/totp-input.png) Read the [Account management](https://docs.phase.dev/access-control/authentication/account) and [2FA](https://docs.phase.dev/access-control/authentication/mfa) docs for details. * * * ## Stream Audit Logs & Secret Events to Datadog Phase can now stream your organisation's audit logs and secret events to **Datadog** in real-time. Create a stream under **Integrations → Log Streams**, and Phase pushes structured events to your Datadog account as they happen. No agents, no polling, no inbound access. ![A healthy Log Stream shipping to Datadog](https://phase.dev/assets/images/changelog/account-management-log-streams/log-stream-card.png) - **Metadata only.** Events describe who did what, where, and when. Secret values, keys, and comments are end-to-end encrypted and never leave Phase. - **Structured for querying.** Events ship as JSON aligned with OpenTelemetry semantic conventions, with Datadog standard attributes mapped at delivery time. Filter by actor, app, environment, event type, or source IP. - **Reliable delivery.** Delivery is at-least-once, in ordered chunks with automatic retries. A transient failure never silently loses an event. Deduplicate on the stable `event.id`. - **Fully observable.** Each stream shows its delivery status, a per-source delivery delay, and a complete per-delivery history with manual re-ship for anything that failed. - **Auditable.** Changes to streams are themselves recorded in the organisation audit log, and export through the stream like any other event. ![Per-delivery history for a Log Stream](https://phase.dev/assets/images/changelog/account-management-log-streams/log-stream-events.png) Read the [Log Streams docs](https://docs.phase.dev/console/logstreams) for the event schema and delivery guarantees. * * * ## Secrets Filtering & Search Qualifiers When an environment holds hundreds of secrets, sort and plain-text search only get you so far. The secrets editor now has a **Filter menu** and **search qualifiers**, in both the single-environment editor and the cross-environment overview. The Filter menu lets you narrow the list by: - **Type**: `secret`, `sealed`, or `config` - **Management**: rotating secrets, dynamic secrets, or secrets with an active personal override - **Tags**: any tag present in the current view If you'd rather stay on the keyboard, the same filters work as GitHub-style qualifiers in the search box: `redis type:config`, `is:rotating`, or `tag:"db creds"`, freely combined with plain-text search. Unknown qualifiers are treated as regular text, so a typo never empties the list. Filters compose the way you'd expect. Values within one category broaden the match (Config + Sealed = either). Different categories narrow it (Config + Rotating = both). Consistent with Phase's end-to-end encryption model, all filtering and search runs entirely client-side. The server never sees your query. * * * ## A Mobile-Friendly Console We have improved Console scaling and responsiveness to work better on mobile screens, across navigation, apps, access control, logs, settings, and onboarding: - **Bottom navigation** with an overflow menu for quick access to every section - **Simplified headers and breadcrumbs** on small screens - **Better scrolling** for tables and the secrets editors - **Dialog and page overflow fixes**, so content fits narrow viewports ![The secrets editor on a mobile screen, with the new bottom navigation](https://phase.dev/assets/images/changelog/account-management-log-streams/mobile-console.png) * * * ## Deploy Phase on Azure AKS with an AI Skill Deploying anything on Kubernetes involves a long tail of environment-specific decisions and failure modes. We released an **AI skill that deploys Phase on Azure Kubernetes Service** for you. Think of it as a forward-deployed engineer you can hand to your infra team. Install it into your AI coding agent (Claude Code, Cursor, Windsurf, or GitHub Copilot) via the [skills](https://skills.sh) ecosystem: ```bash npx skills add phasehq/ai -s aks ``` Then ask your agent to *"deploy Phase on AKS"*. The skill interviews you about the deployment: custom domains, Tailscale ingress and egress, an in-cluster or external managed database, backups, region and resource groups, and connectivity to private services like a LiteLLM gateway. It then plans and executes the rollout. Sensitive steps stay in your hands: the agent stops and asks you to generate credentials and passwords yourself rather than handling them on your behalf. When something goes wrong mid-deploy, as it often does with Kubernetes, the skill works through the relevant documentation and troubleshooting guides to fix the issue on its own. It stays useful beyond day one: keep it installed to help harden and maintain the deployment over time. The full collection also includes skills for [Docker Compose, generic Kubernetes, and AWS EKS](https://github.com/phasehq/ai) deployments. Install everything with `npx skills add phasehq/ai`. Two step-by-step Helm deployment guides are also live in the docs: [Azure AKS](https://docs.phase.dev/self-hosting/azure-aks) and [AWS EKS](https://docs.phase.dev/self-hosting/aws-eks). The AKS guide covers standard networking, private Tailscale-only access, and publishing via Tailscale Funnel. * * * ## Phase Cloud Egress IP Ranges If Phase Cloud syncs secrets to infrastructure behind a firewall (a self-hosted GitLab, an internal Vault, a private gateway), you can now allowlist the static IP addresses that Phase Cloud egress traffic originates from. The list is published as a machine-readable source of truth, updated in advance of any change: ```bash curl -s https://docs.phase.dev/cloud/ips.txt ``` See the [Egress IP addresses](https://docs.phase.dev/security#egress-ip-addresses) section of the security docs for details and the JSON variant. * * * ## CLI v2.3.1 A patch release with two fixes: - **`PHASE_VERIFY_SSL` now works.** The CLI's SSL error message has long suggested setting `PHASE_VERIFY_SSL=False` to bypass certificate verification, but the variable wasn't being read. It now works across all commands, including the pre-auth external identity flows (`phase auth --mode aws-iam` / `--mode azure`) against self-hosted instances with self-signed certificates. The flag is fail-closed: verification stays on unless the value is exactly `false`. It is intended for development and break-glass use. For production, trust your CA instead. - **Installer fix for binary installs.** On systems that install via the standalone binary path (e.g. Arch Linux), upgrading from CLI v1 could delete the freshly installed v2 binary while cleaning up v1 leftovers, leaving no `phase` command at all. The installer now preserves the new binary while removing the legacy files. Thanks to first-time contributor [@sundaram2021](https://github.com/sundaram2021) for the SSL fix. * * * ## Security Two security fixes shipped this cycle. **If you self-host, upgrade to the latest Console release.** - **GitHub integration hardening.** The GitHub integration's OAuth connection flow is now bound to the session that started it, with stricter callback validation. Tracked as [GHSA-68r4-53vq-4fqm](https://github.com/phasehq/console/security/advisories/GHSA-68r4-53vq-4fqm) and fixed in Console v2.73.2. - **Legacy service tokens scoped correctly.** Legacy service tokens can now only access the environments they were provisioned for. To be clear on scope, the GitHub fix does not affect you if you use GitHub to log in to Phase (OAuth SSO). It only affects instances that have a GitHub OAuth integration configured. If that's you, we strongly advise upgrading. As a precautionary measure, if you had a GitHub or GitHub Enterprise integration set up and your instance is publicly exposed, please also rotate your GitHub OAuth integration key. More details are in the [security advisory](https://github.com/phasehq/console/security/advisories/GHSA-68r4-53vq-4fqm). **Phase Cloud users: you're good.** No action needed on your end. * * * ## Other improvements and fixes - **Sync status for custom roles.** Viewing syncs no longer fails for members whose role lacks access to integration credentials. - **Faster log purging.** Retention-based audit log cleanup is faster and lighter on the database for large self-hosted instances. - **Service Account access for Managers.** Members with the default Manager role are now correctly provisioned with Service Account handler keys, so they can generate tokens and manage key storage settings as their role's permissions indicate. - **Instant secret type updates in the cross-environment editor.** Changing a secret's type updates value visibility immediately, and sealed secrets show their locked state right after deploying, with no page refresh needed. - **Secret row menu polish.** The hover menus on secret rows now align flush with their fields, blend correctly when a field is focused, and size consistently across screen sizes. Long comments no longer overflow the key column. * * * All features are live on [Phase Cloud](https://console.phase.dev) and available in the latest releases for self-hosted users. As always, we'd love your feedback. Come say hi on [Slack](https://slack.phase.dev), [X](https://x.com/phasedotdev), or [GitHub](https://github.com/phasehq). RoadmapCommunity-driven Request a feature We build features based on community requests and feedback. Looking for a specific feature or have a use-case in mind? Reach out to us. [Feature request](https://github.com/phasehq/console/issues/new?template=feature_request.md) DeploymentSelf-hosted / Cloud Get started ## Keep your secrets Self-host or start on fully managed Cloud in under a minute. Self-hosted Run Phase on your own infrastructure. Free and open source. AI agent deployment skill [![Docker Compose logo](https://phase.dev/assets/images/docker.svg)](https://docs.phase.dev/self-hosting/docker-compose)[![Kubernetes logo](https://phase.dev/assets/images/kubernetes.svg)](https://docs.phase.dev/self-hosting/kubernetes)[![AWS logo](https://phase.dev/assets/images/aws.svg)](https://docs.phase.dev/self-hosting/aws-eks)[![GCP logo](https://phase.dev/assets/images/gcp.svg)](https://docs.phase.dev/self-hosting/gcp)[![Azure logo](https://phase.dev/assets/images/azure.svg)](https://docs.phase.dev/self-hosting/azure)[![Railway logo](https://phase.dev/assets/images/railway.svg)](https://docs.phase.dev/self-hosting/railway)[![Raspberry Pi logo](https://phase.dev/assets/images/raspberry.svg)](https://docs.phase.dev/self-hosting/raspberrypi) [Self-hosting guide](https://docs.phase.dev/self-hosting) Cloud Fully managed. From signup to your first secret in 60 seconds. Sign up with [Google](https://console.phase.dev/login?provider=google)[GitHub](https://console.phase.dev/login?provider=github)[GitLab](https://console.phase.dev/login?provider=gitlab)