Security Alerts

QuickBox emails you whenever something sensitive happens on your account: your password changes, a passkey is added, an API key is rotated, someone signs in from somewhere new. The alerts exist so you hear about a change even when the change was not yours. If you did not do the thing an alert describes, the email and this page tell you what to do next.

Alerts show when the change happened and where it came from: the time and IP address on all of them, and on most also the device and a best-effort location. Match those against what you were doing.

To ask about an alert, email echo@quickbox.io with [Security] at the start of the subject.

All the security emails at a glance

Each subject line starts with a small icon, which is left out of the table.

All of these are sent whatever you choose in Notification settings. The Security Alerts tile there only decides whether a password change also adds a card to your Inbox.

Password changed

Subject: Your QuickBox Pro Password Was Changed

Sent when. Your password is updated, in either of two ways:

• You used the Password section on the Security tab, which needs your current password.
• You clicked a reset link from the Forgot password page and chose a new password.

What to do.

• It was you. Nothing. This is your receipt.
• It was not you. Treat the account as taken. Follow If you did not expect one below straight away.

Active sessions ended

Subject: Active Sessions Ended on Your QuickBox Pro Account

Sent when. Every sign-in on your account is ended. This arrives together with the password-changed email whenever you change or reset your password. It also arrives if an administrator ends your sessions.

What to do. If you just changed your password, this is expected and you only need to sign in again. If it arrives with no password-changed email beside it, someone else ended your sessions: reset your password from the sign-in page.

Primary email changed

Subject: Your QuickBox Pro Primary Email Was Changed

Sent when. The primary email address on your account changes. The old address and the new address both get a copy, and so does a verified secondary address. The old address is told so that a lost or compromised inbox cannot quietly move the account away from its real owner.

What to do.

• It was you. Nothing more.
• It was not you. The copy in your old inbox is the warning that someone is taking the account. Start a password reset at once and email echo@quickbox.io with [Security] at the start of the subject.

Secondary email added

Subject: Secondary Email Added on Your QuickBox Pro Account

Sent when. A secondary (recovery) address is verified on your account. Only the primary inbox gets this one, on purpose: a recovery address can be used to take an account over later, so the owner must hear about a new one.

What to do. If you did not add it, reset your password and email echo@quickbox.io with [Security] at the start of the subject so it can be removed.

API key changed

Subject: API Key Created on Your QuickBox Pro Account, or Rotated, or Revoked, to match the action.

Sent when. An API key tied to one of your licences is touched:

• Created. A key was issued for a licence.
• Rotated. An existing key was regenerated. The old key is revoked and the new one replaces it, so anything still using the old key stops working.
• Revoked. A key was revoked for good, and tools still using it fail on their next call.

The email shows the key label and the first characters of the key, never the whole key, so you can match it to one of yours.

What to do.

• It was you. Put the new key into the servers that use it. See Licenses and API keys.
• It was not you. Open License Management → API keys in the sidebar, revoke every key you do not recognize, then reset your password.

New sign-in

Subject: New Sign-In to Your QuickBox Pro Account

Sent when. A successful password sign-in comes from a network and a country that match none of your recent sign-ins. Your last 50 sign-ins within the past 30 days are compared by network (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address) and by country. A sign-in is unusual only when it matches neither. Your very first sign-in is never flagged.

What to do.

• It was you. Travel, a new internet provider and hotel Wi-Fi are the usual reasons. Ignore the email.
• It was not you. Reset your password, which ends every session, then follow the rest of If you did not expect one.

There is no switch for this alert in your own settings.

Unusual failed sign-ins

Subject: Unusual Failed Sign-In Attempts on Your QuickBox Pro Account

Sent when. Five wrong passwords are entered for your email address within 15 minutes. No sign-in succeeded; this is an early warning that someone may be guessing.

Once the fifth attempt fails, the portal also refuses further attempts for that email, whether the password is right or wrong, until the 15 minutes are over. The sign-in page then says “Too many attempts. Try again in a few minutes.” Your account is not locked; the pause simply ends when the 15 minutes are over.

What to do.

• It was you, mistyping. Wait out the window, then sign in. Use Forgot password? if you cannot remember it.
• It was not you. The guesses failed, but reset your password anyway and add two-factor authentication or a passkey so a stolen password is not enough.

There is no switch for this alert in your own settings.

Sign-in method alerts

Three more emails tell you when the ways you sign in change. Each also carries the time and IP address of the change.

If you did not make the change, someone else is signed in to your account or holds your password. Reset your password, then review the Security and Connections tabs.

If you did not expect one

If an alert describes something you did not do, treat the account as possibly compromised and work through these steps in order.

1. Reset your password. Type quickbox.io/login into your browser, click Forgot password? and set a new one. Do this from a device you trust. A reset ends every existing sign-in on the account.
2. Check your API keys. Open License Management → API keys in the sidebar and revoke any key you do not recognize. Your servers just need the new key pasted back in.
3. Strengthen sign-in. On the Security tab, turn on two-factor authentication and register a passkey. Remove any passkey you do not recognize.
4. Check Discord. On the Connections tab, confirm the linked Discord account is yours. Unlink it if it is not.
5. Ask for help. If you cannot sign in at all, email echo@quickbox.io with [Security] at the start of the subject.

Best practices

FAQ

Related pages