[Due for payment 2025-02-28] 2FA - App allows to proceed without copying the recovery codes

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email [email protected] to request to join our Slack channel!

---

Version Number: 9.1.3-0
Reproducible in staging?: Y
Reproducible in production?: N
If this was caught on HybridApp, is this reproducible on New Expensify Standalone?: Y
If this was caught during regression testing, add the test name, ID and link from TestRail: #54404
Email or phone of affected tester (no customers): [email protected]
Issue reported by: Applause - Internal team

Action Performed:

1. Launch hybrid or ND app
2. Go to Account settings > Security
3. Go to Two-factor authentication
4. Tap Copy
5. Tap Next
6. Swipe back two times (do not use app back button) (important step)
7. Go to Security
8. Go to Two-factor authentication
9. Without tapping Copy, tap Next

Expected Result:

App will regenerate new codes and will not allow to proceed without copying the recovery codes

Actual Result:

App does not regenerate new code and it allows to proceed without copying the recovery codes

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Standalone
• Android: HybridApp
• Android: mWeb Chrome
• iOS: Standalone
• iOS: HybridApp
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6749581_1740097515047.ScreenRecording_02-21-2025_08-22-08_1.mp4

View all open jobs on GitHub

[melvin-bot]

Triggered auto assignment to @robertjchen (DeployBlockerCash), see https://stackoverflowteams.com/c/expensify/questions/9980/ for more details.

[melvin-bot]

💬 A slack conversation has been started in #expensify-open-source

[github-actions]

👋 Friendly reminder that deploy blockers are time-sensitive ⏱ issues! Check out the open `StagingDeployCash` deploy checklist to see the list of PRs included in this release, then work quickly to do one of the following:

1. Identify the pull request that introduced this issue and revert it.
2. Find someone who can quickly fix the issue.
3. Fix the issue yourself.

[blazejkustra]

This is a regression from my PR. I'm going to look into it now!

@lanitochka17 Could you attach a video?

[blazejkustra]

PR is up cc @shubham1206agra

[melvin-bot]

Reviewing label has been removed, please complete the "BugZero Checklist".

[melvin-bot]

The solution for this issue has been 🚀 deployed to production 🚀 in version 9.1.3-4 and is now subject to a 7-day regression period 📆. Here is the list of pull requests that resolve this issue:

• [CP Staging] Disallow proceeding without copying recovery codes #57251

If no regressions arise, payment will be issued on 2025-02-28. 🎊

For reference, here are some details about the assignees on this issue:

• @blazejkustra does not require payment (Contractor)
• @shubham1206agra requires payment through NewDot Manual Requests