Account Security
Practical account hygiene: protecting the email that identifies the account, handling proxy credentials, and what to do if you suspect a breach.
Last updated
Two kinds of secret protect the account, and they are worth treating differently.
| Secret | What it protects | Where it lives |
|---|---|---|
| Account password | Sign-in, the dashboard, and billing | Set by you; recoverable through support |
| Proxy username and password | The traffic on a product | Generated per sub-user; changeable from the dashboard |
The account password
- Use a unique password. Reusing one from another site means a breach elsewhere becomes a breach here.
- Store it in a password manager rather than a note or a browser-only save.
- Change it if you have any reason to believe it is known to someone else. See Change Your Password.
The email address is the account identity. Protect the mailbox: if someone else can receive mail at that address, they can impersonate you with support and may be able to take over the account.
Proxy credentials
Proxy credentials are separate from your login and are what your tools actually use. Two properties matter.
They are per sub-user. Each sub-user has its own username and password, so a tool can be revoked without affecting anything else. Rotating one does not disturb the others.
They are recoverable in the dashboard. If a credential has been pasted into a script that is now public, rotate it rather than hoping it goes unnoticed. See Reset a Sub-user Password.
Never commit proxy credentials to a public repository, and do not put them in client-side code that ships to a browser. On the dashboard side, credentials are shown only to the account owner.
If you suspect the account is compromised
Work through this in order.
- Change the account password, which invalidates other sessions.
- Check the Billing page for payments you do not recognise, using Download an Invoice.
- Rotate every sub-user credential, using Reset a Sub-user Password.
- Review the sub-user list for users you did not create, using Sub-users.
- Contact support at
support@lightningbytes.com, describing what you found and what you changed.
Legal and policy pages
The account is governed by the site's own documents, linked in the footer: Terms, Privacy policy, and Acceptable use. The acceptable-use page is the one to read before pointing proxies at a target, because it sets out what the service may and may not be used for.