# Passkey confirmation for vault changes, and use only for databases 2026-10-28 · Security > Changing where a secret may go, or showing it, needs your passkey, checked by the key service itself. The key service also reports every change to your protection to you directly. Three changes to the vault, enforced by the key service rather than the app. **Your passkey confirms what matters.** Adding a host to "allowed for", switching an entry back to visible and showing a value now need a fresh passkey confirmation, checked by the key service itself. It is tied to that one action on that one entry, valid for 60 seconds and usable once. *The browser signs the exact change, the app passes it on, and the key service verifies it before anything is applied or revealed.* **The key service tells you itself.** Every change to your protection is reported by the key service directly, by push message and email, without passing through the app: a new or removed passkey, a reset, a host added, a value shown. A taken-over app cannot hold these back. **Passkeys cannot be swapped quietly.** A new passkey counts only after an existing one confirms it. Removing and resetting need a signature too. If every passkey is lost, the key service emails a link to your account address and waits 72 hours after you confirm. After a first passkey or a reset, a waiting period (24 and 48 hours) blocks every confirmation. **Databases.** "Use only" now works for Postgres and MySQL or MariaDB. The key service completes the login with the real value and requires TLS with a checked certificate. A target without TLS is refused, unless you mark that one entry "TLS not available", which needs your passkey and is reported at once. Git services and the registrar no longer fetch values: they borrow a short-lived placeholder. Limits: unreadable without your confirmation. A passkey prompt does not show what you confirm, so a taken-over app could still talk you into one, and you would see the message right after. SSH stays at visible or locked. After a database login the data stream is not scanned for the value.