You can enable two-factor authentication (2FA) on the personal data screen. Add the setup key to your authenticator app and enter the code it shows. 2FA is not enabled until the code verifies — so a wrong setup cannot lock you out.
With 2FA on, sign-in asks for a 6-digit code in addition to your password. Turning it off needs both your password and a valid code.
Changing your password automatically signs out sessions on other devices.
From the devices and sessions list you can remotely end a session you don't recognise. IP addresses are partly hidden on screen.
The security log lists sign-ins, sign-ins from new devices, password changes, 2FA changes and withdrawal requests with dates. Security notifications cannot be turned off.
Note: email verification and email security alerts are not available yet — mail sending is not set up on the server.