If you suspect someone else has access to your account, changing your password should end their session. Previously it didn't: existing sessions kept working until their tokens expired on their own.

Now, changing your password — or completing a password reset — immediately invalidates every other active session across every device and browser. Anyone else signed in as you is returned to the login screen on their next request.

The tab you're currently using stays signed in. You change your password and carry on working; everyone else gets logged out.

This applies to both routes into a new password:

Settings → Account → Change password
The Forgot password email reset flow

What this doesn't cover yet

There's no per-device session list yet — you can't see "signed in on Chrome, Windows" and revoke that one device individually. Right now revocation is all-or-nothing via a password change. A device list is on the roadmap.

Nothing changes for your teammates' sessions when you remove or deactivate a member: those were already cut off immediately, because membership and role are re-checked on every single request.