Dealing with a hacked user account should not require the console

dccmuseum
Tue, 17 Mar 2026 11:50:06 +0000
Self-hosting

Hi all,

one of our users had their account compromised. The workflow to mitigate that was far from ideal.

The rails console was needed for:

Force changing the e-mail address

Force changing the password to something random to force a password reset via e-mail

Killing all active sessions

Furthermore, we found that the e-mail change was only visible in the outbound e-mail logs and nowhere else.

The AI spam-detector caught that spam for new accounts, but wasn’t enabled for this trust level and number of posts. Maybe it would be a good idea to include the option to enable the AI spam-detector for changing countries and/or no post in over a year.

Thanks all for the great software over the years, despite minor flaws like this.

14 posts - 3 participants