Security and operations

• No SMS codes. The second factor is an authenticator app or a security key. Deliberate.
• API keys carry no second factor. When an organization requires two-factor authentication, the keys of a member who has not enrolled stop working.
• Antivirus is off unless configured. Quasar supports ClamAV, and files above the scanner's limit are marked not scanned. A new installation has no scanner until one is configured.
• Backups. Taken and kept by the operator of the installation. There is no restore button in the application.