@leocg If sending a code to user's phone is a security issue then using a 2FA code generated by the same phone is a security issue too