Security recommendations for your account

The recommendations below help you protect your blackbox.md account, the app.blackbox.md panel, your API tokens and your servers. The security settings are on blackbox.md, in your account, “Contul meu” (My account), at blackbox.md/account, and in the panel, under “Security” (app.blackbox.md/security) and “Settings” (app.blackbox.md/settings). At the end you will find the steps to take, in order, if you suspect that someone else has accessed your account.

Available to: the owner of the blackbox.md account and of the servers ordered from that account.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Where to find your security settings

Account password

• Use a long, unique password that a password manager generates and stores for you. The minimum: 12 characters, with at least 3 of these: uppercase letter, lowercase letter, digit, special character.
• Do not reuse the password on other sites, and do not use it as the root password on your servers.
• Change your password on blackbox.md (“Profil” (Profile) → “Schimbă parola” (Change password)), not in the panel. Each time you click “Deschide panoul” (Open the panel), the panel takes over your account password, so a password changed only in the panel gets overwritten. Steps: Changing your account password.
• If you sign in with Google or GitLab, your BLACKBOX account is only as secure as that account. Turn on two-factor authentication there.

Two-factor authentication in the panel

1. In the panel, open “Security” (or the user menu → “Security & 2FA”).
2. Click “Enable Two-Factor Authentication” and follow the steps in Two-factor authentication (2FA) in the panel.
3. Save the 8 recovery codes offline: on paper or in a password manager, not on the phone that has your authenticator app. Each code can be used only once.

Once 2FA is on, the panel asks for a code every time you sign in, including when you open it from your account with “Deschide panoul” (Open the panel). If you check “Remember this device for 30 days”, the panel stops asking for the code when you open it again from your account in the same browser. Check this option only on your own personal computer. If you lose your phone, see Lost your 2FA device.

Account email

• Keep your email verified: under “Securitatea contului” (Account security) you should see “Verificat” (Verified). Without verification you cannot open the panel from your account. See Verifying your email address.
• Protect your mailbox with a strong password and 2FA at your email provider. This is where you receive notifications about your services, invoices and servers.
• The address cannot be changed from the account page. To use a new address, contact us.

API tokens

• Grant only the permissions you need. The three read permissions are checked by default; when you check any of the other five, it shows the warning “Atenție: cu această permisiune asistentul AI va putea …” (Warning: with this permission, the AI assistant will be able to …). The “AI-administrator — acces complet” (AI administrator — full access) button checks all permissions: the assistant will be able to run any command as root, see passwords and keys, and spend from your balance.
• Create a separate token for each AI client or device, with a clear name such as “Claude Desktop (laptop)”. If you lose your laptop, you only need to revoke that one token.
• Keep the token in a password manager or in an environment variable. Do not put it in code, git repositories, screenshots or conversations.
• Check the “Ultima utilizare” (Last used) column regularly (it updates with a delay of up to one minute). Click “Revocă” (Revoke) for tokens you no longer use or do not recognize.
• A token's permissions cannot be changed. If you need different permissions, create a new token and revoke the old one.

Details: Token and AI agent security.

Servers: SSH keys and the root password

• Use SSH keys instead of a password. Generate a key (Generating an SSH key (Windows, macOS, Linux)), add it to the server with “Add SSH key” and check that you can connect with it. Then click “Disable password login”: the card will show “Key-only”.
• Remove keys you no longer use from each server: on the server card, “Add SSH key” → “Installed keys” → “Remove”. Deleting a key in “Contul meu” (My account) → “Chei SSH” (SSH keys) does not remove it from your servers. Details: Adding and removing SSH keys on the server.
• Do not remove the “Management key (blackbox.md)”, and do not delete it by hand from authorized_keys either: without it, password reset, key management, and turning password login on or off from the panel stop working. See BLACKBOX keys on your server.
• Never give anyone your root password. For temporary access, for example for an outside administrator, add their public key and remove it once the work is done. If you did share the password, reset it right afterward with “Reset password”: Resetting the root password.
• Also change the initial root password you received when the server was activated, using the same “Reset password” button.

Warning Before you disable password login or remove keys, check in a separate window that you can connect with your key, and keep your current SSH session open until you are done. There is no web console for customers: if you lose access, contact us.

The full checklist for a new server: Securing a new server: checklist.

What you should never send

Never send passwords, API tokens, private SSH keys or recovery codes by email, chat or support ticket, not even to BLACKBOX support. For a server problem, the order number (BBX-…) and the IP address are enough. Your public key (the .pub file) is safe to send. If you have already sent a secret, change or revoke it immediately.

If you suspect a compromise

Follow these steps in this order:

1. Change your account password: “Contul meu” (My account) → “Profil” (Profile) → “Schimbă parola” (Change password), enter your current password and a new one, then click “Salvează parola” (Save password). The message “Parola a fost schimbată. Vă rugăm autentificați-vă din nou.” (Your password has been changed. Please sign in again.) appears and you are signed out automatically. All sessions on blackbox.md end, and the API tokens created up to that point stop working. Sign in with your new password.
2. In “Token-uri API” (API tokens), click “Revocă” (Revoke) for every token. The list does not show that the password change has disabled them; once you revoke them, their status is clear. Create new tokens only for the AI clients you will keep using.
3. Open the panel with “Deschide panoul” (Open the panel) so that it also picks up the new password. Go to “Settings” → “Sessions” → “Sign Out Everywhere” and confirm. All panel sessions end, and the devices remembered for 2FA are forgotten. Then open the panel again from your account.
4. For each server in “My Servers”, click “Reset password” and confirm. The old password stops working immediately, and the new one appears on the server card: save it in your password manager. If reset_failed appears, the password was not changed: check that the server is running and try again; if the error repeats, contact us.
5. For each server, open “Add SSH key” → “Installed keys” and remove the keys you do not recognize. Do not touch the “Management key (blackbox.md)”. The key with the comment blackbox-agent-… is used by the AI assistant for SSH access; you can remove it, since the panel does not depend on it (BLACKBOX keys on your server).
6. Write to us at support@blackbox.md or open a ticket (Opening a support ticket). Describe what you noticed and which steps you have taken, without including any passwords.

Important If you sign in only with Google or GitLab, the “Parolă” (Password) section does not appear in your account. In step 1, change the password of your Google or GitLab account and end its active sessions there. Sessions already open on blackbox.md expire on their own within 8 hours at most. In this case the API tokens are not disabled automatically, so in step 2 revoke all of them.

What each action ends:

If the server itself appears to have been hacked, see Your server was hacked or is under attack: what to do.

Responsibility for your account

Under the Terms and Conditions (§3), you are responsible for the activity in your account and for protecting your passwords, SSH keys, API tokens and second authentication factor. Whatever an AI assistant does with your token is done on your behalf. BLACKBOX is not liable for third parties' use of your account unless there is a proven breach of its own systems.

Frequently asked questions

My AI assistant stopped connecting after I changed my password. Why? Changing your password disables all API tokens created before the change. Create a new token in “Token-uri API” (API tokens) and put it in your AI client's settings.

How do I give access to a colleague or an outside administrator? You cannot add other users to your account yourself. For access to a server, add the person's public key and remove it once the work is done. Do not share your account password, your root password or an API token. For other kinds of access, contact us.

I can't sign in to my account. What should I do? See Forgot your account password and contact us as soon as possible at support@blackbox.md or call +373 78 003948, Monday–Friday, 09:00–18:00 (Moldova time).