← Back to account
Account security

Sessions and password recovery

Control where your BioRegen account stays signed in. Protected account requests must now pass both the signed-cookie check and the server-side revocation check.

Checking your current account session…
Current browser

Sign out this browser

Clears this browser’s cookie and revokes the exact presented session token until it would naturally expire.

All sessions

Log out everywhere

Use this after losing a device, using a shared browser, or seeing activity you do not recognize. Every older BioRegen session for this customer account is refused.

Password recovery

Send a password-reset link

A successful password reset rotates the credential, invalidates older sessions, and signs the resetting browser into a fresh session.

Security contract

What BioRegen checks

The browser cookie is host-only, HttpOnly, Secure, SameSite=Lax, HMAC-signed, and short-lived. Server-side RATE_KV markers can refuse one exact token or every older session for the customer.

If the revocation store cannot be checked, protected account data fails closed with a temporary-unavailable response rather than bypassing the decision.

Research-use-only account. BioRegen account and order tools support laboratory and educational research materials. They do not provide medical care or individual treatment guidance.