diff --git a/__tests__/api/security-sessions.test.ts b/__tests__/api/security-sessions.test.ts
new file mode 100644
index 0000000..1661a08
--- /dev/null
+++ b/__tests__/api/security-sessions.test.ts
@@ -0,0 +1,140 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextRequest } from 'next/server'
+
+const { mockSql } = vi.hoisted(() => ({
+  mockSql: vi.fn(),
+}))
+
+vi.mock('@/lib/db', () => ({
+  sql: Object.assign(mockSql, { raw: vi.fn() }),
+}))
+
+vi.mock('@/lib/auth/middleware', async () => {
+  const actual = await vi.importActual<
+    typeof import('@/lib/auth/middleware')
+  >('@/lib/auth/middleware')
+  const injectAuth = (handler: (...args: unknown[]) => unknown) =>
+    async (request: unknown, ...rest: unknown[]) =>
+      handler(request, { walletAddress: 'GWALLET', tokenJti: 'jti' }, ...rest)
+  return { ...actual, withAuth: injectAuth, withAuthCtx: injectAuth }
+})
+
+vi.mock('@/lib/security/rateLimit', () => ({
+  enforceRateLimit: vi.fn(async () => null),
+  buildRateLimitKey: vi.fn(() => 'test-key'),
+}))
+
+import { GET } from '@/app/api/auth/sessions/route'
+import { POST } from '@/app/api/auth/sessions/[id]/revoke/route'
+
+function row() {
+  return {
+    id: 1,
+    jti: 'secret-jti',
+    user_agent: 'Mozilla/5.0 (Windows NT 10.0) Chrome/120.0',
+    ip_address: '203.0.113.10',
+    created_at: '2026-01-01T00:00:00.000Z',
+    last_used_at: null,
+    expires_at: '2030-01-01T00:00:00.000Z',
+    revoked_at: null,
+    replaced_by_jti: null,
+  }
+}
+
+function revokeRequest(id: string) {
+  return {
+    request: new NextRequest(
+      `http://localhost/api/auth/sessions/${id}/revoke`,
+      { method: 'POST' }
+    ),
+    context: { params: Promise.resolve({ id }) },
+  }
+}
+
+describe('GET /api/auth/sessions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns the wallet sessions without sensitive fields', async () => {
+    mockSql.mockResolvedValueOnce([row()])
+
+    const response = await GET(
+      new NextRequest('http://localhost/api/auth/sessions')
+    )
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.data.sessions).toHaveLength(1)
+    expect(body.data.sessions[0].id).toBe(1)
+    expect(body.data.sessions[0].status).toBe('active')
+
+    const serialized = JSON.stringify(body)
+    expect(serialized).not.toContain('secret-jti')
+    expect(serialized).not.toContain('token_hash')
+  })
+
+  it('returns 500 when the query fails', async () => {
+    mockSql.mockRejectedValueOnce(new Error('db down'))
+
+    const response = await GET(
+      new NextRequest('http://localhost/api/auth/sessions')
+    )
+    const body = await response.json()
+
+    expect(response.status).toBe(500)
+    expect(body.code).toBe('SESSIONS_LOAD_FAILED')
+  })
+})
+
+describe('POST /api/auth/sessions/[id]/revoke', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('rejects a non-numeric session id', async () => {
+    const { request, context } = revokeRequest('not-a-number')
+    const response = await POST(request, context)
+    expect(response.status).toBe(400)
+    const body = await response.json()
+    expect(body.code).toBe('INVALID_SESSION_ID')
+  })
+
+  it('returns 404 when the session is not owned by the wallet', async () => {
+    mockSql.mockResolvedValueOnce([])
+    const { request, context } = revokeRequest('9')
+    const response = await POST(request, context)
+    expect(response.status).toBe(404)
+    const body = await response.json()
+    expect(body.code).toBe('SESSION_NOT_FOUND')
+  })
+
+  it('revokes an owned active session', async () => {
+    mockSql.mockResolvedValueOnce([{ id: 9 }])
+    mockSql.mockResolvedValueOnce([{ id: 9 }])
+    const { request, context } = revokeRequest('9')
+    const response = await POST(request, context)
+    const body = await response.json()
+    expect(response.status).toBe(200)
+    expect(body.data).toEqual({ id: 9, status: 'revoked' })
+  })
+
+  it('returns 409 when the session is no longer revocable', async () => {
+    mockSql.mockResolvedValueOnce([{ id: 9 }])
+    mockSql.mockResolvedValueOnce([])
+    const { request, context } = revokeRequest('9')
+    const response = await POST(request, context)
+    expect(response.status).toBe(409)
+    const body = await response.json()
+    expect(body.code).toBe('SESSION_NOT_REVOCABLE')
+  })
+
+  it('returns 500 when revocation fails unexpectedly', async () => {
+    mockSql.mockRejectedValueOnce(new Error('db down'))
+    const { request, context } = revokeRequest('9')
+    const response = await POST(request, context)
+    expect(response.status).toBe(500)
+    const body = await response.json()
+    expect(body.code).toBe('SESSION_REVOKE_FAILED')
+  })
+})
diff --git a/__tests__/auth/sessions.test.ts b/__tests__/auth/sessions.test.ts
new file mode 100644
index 0000000..de20a71
--- /dev/null
+++ b/__tests__/auth/sessions.test.ts
@@ -0,0 +1,265 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+
+const { mockSql } = vi.hoisted(() => ({
+  mockSql: vi.fn(),
+}))
+
+vi.mock('@/lib/db', () => ({
+  sql: Object.assign(mockSql, { raw: vi.fn() }),
+}))
+
+vi.mock('@/lib/auth/crypto', () => ({
+  sha256Hex: (value: string) => `hash:${value}`,
+}))
+
+import {
+  groupSessionRows,
+  listSecuritySessions,
+  revokeWalletSession,
+  type RevokeSessionResult,
+} from '@/lib/auth/sessions'
+import {
+  buildSecurityAlerts,
+  parseUserAgent,
+  type SecuritySession,
+} from '@/lib/auth/session-types'
+
+interface RowOverrides {
+  id?: number | string
+  jti?: string
+  user_agent?: string | null
+  ip_address?: string | null
+  created_at?: string
+  last_used_at?: string | null
+  expires_at?: string
+  revoked_at?: string | null
+  replaced_by_jti?: string | null
+}
+
+function row(overrides: RowOverrides = {}) {
+  return {
+    id: 1,
+    jti: 'jti-1',
+    user_agent: 'Mozilla/5.0 (Windows NT 10.0) Chrome/120.0',
+    ip_address: '203.0.113.10',
+    created_at: '2026-01-01T00:00:00.000Z',
+    last_used_at: null,
+    expires_at: '2030-01-01T00:00:00.000Z',
+    revoked_at: null,
+    replaced_by_jti: null,
+    ...overrides,
+  }
+}
+
+function session(overrides: Partial<SecuritySession> = {}): SecuritySession {
+  return {
+    id: 1,
+    status: 'active',
+    current: false,
+    device: {
+      browser: 'Chrome',
+      os: 'Windows',
+      type: 'desktop',
+      label: 'Chrome on Windows',
+    },
+    ipAddress: '203.0.113.10',
+    loginAt: '2026-01-01T00:00:00.000Z',
+    lastActiveAt: '2026-01-01T00:00:00.000Z',
+    expiresAt: '2030-01-01T00:00:00.000Z',
+    revokedAt: null,
+    ...overrides,
+  }
+}
+
+describe('parseUserAgent', () => {
+  it('detects desktop chrome on windows', () => {
+    const device = parseUserAgent(
+      'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 Safari/537.36'
+    )
+    expect(device.browser).toBe('Chrome')
+    expect(device.os).toBe('Windows')
+    expect(device.type).toBe('desktop')
+    expect(device.label).toBe('Chrome on Windows')
+  })
+
+  it('detects mobile safari on iOS', () => {
+    const device = parseUserAgent(
+      'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0) Version/17.0 Mobile/15E148 Safari/604.1'
+    )
+    expect(device.os).toBe('iOS')
+    expect(device.type).toBe('mobile')
+    expect(device.browser).toBe('Safari')
+  })
+
+  it('handles a missing user agent safely', () => {
+    expect(parseUserAgent(null)).toEqual({
+      browser: 'Unknown browser',
+      os: 'Unknown OS',
+      type: 'unknown',
+      label: 'Unknown device',
+    })
+  })
+})
+
+describe('groupSessionRows', () => {
+  const now = Date.parse('2026-01-10T00:00:00.000Z')
+
+  it('collapses a rotation chain into a single session', () => {
+    const rows = [
+      row({
+        id: 3,
+        jti: 'c',
+        created_at: '2026-01-05T00:00:00.000Z',
+        last_used_at: '2026-01-06T00:00:00.000Z',
+      }),
+      row({
+        id: 2,
+        jti: 'b',
+        created_at: '2026-01-03T00:00:00.000Z',
+        revoked_at: '2026-01-05T00:00:00.000Z',
+        replaced_by_jti: 'c',
+      }),
+      row({
+        id: 1,
+        jti: 'a',
+        created_at: '2026-01-01T00:00:00.000Z',
+        revoked_at: '2026-01-03T00:00:00.000Z',
+        replaced_by_jti: 'b',
+      }),
+    ]
+
+    const sessions = groupSessionRows(rows, { now })
+
+    expect(sessions).toHaveLength(1)
+    expect(sessions[0].id).toBe(1)
+    expect(sessions[0].status).toBe('active')
+    expect(sessions[0].loginAt).toBe('2026-01-01T00:00:00.000Z')
+    expect(sessions[0].lastActiveAt).toBe('2026-01-06T00:00:00.000Z')
+  })
+
+  it('marks revoked and expired tips', () => {
+    const rows = [
+      row({ id: 1, jti: 'a', revoked_at: '2026-01-02T00:00:00.000Z' }),
+      row({
+        id: 2,
+        jti: 'b',
+        created_at: '2025-01-01T00:00:00.000Z',
+        expires_at: '2025-06-01T00:00:00.000Z',
+      }),
+    ]
+
+    const sessions = groupSessionRows(rows, { now })
+    const byId = new Map(sessions.map((s) => [s.id, s]))
+
+    expect(byId.get(1)?.status).toBe('revoked')
+    expect(byId.get(2)?.status).toBe('expired')
+  })
+
+  it('flags the current session from its jti', () => {
+    const rows = [
+      row({ id: 1, jti: 'a' }),
+      row({ id: 2, jti: 'b', created_at: '2026-01-02T00:00:00.000Z' }),
+    ]
+
+    const sessions = groupSessionRows(rows, { now, currentJti: 'a' })
+    expect(sessions.find((s) => s.id === 1)?.current).toBe(true)
+    expect(sessions.find((s) => s.id === 2)?.current).toBe(false)
+  })
+
+  it('never exposes token material', () => {
+    const rows = [row({ id: 1, jti: 'secret-jti' })]
+    const sessions = groupSessionRows(rows, { now })
+    expect(JSON.stringify(sessions)).not.toContain('secret-jti')
+    expect(JSON.stringify(sessions)).not.toContain('token_hash')
+  })
+})
+
+describe('buildSecurityAlerts', () => {
+  const now = Date.parse('2026-01-10T00:00:00.000Z')
+
+  it('returns no alerts for a single current session', () => {
+    const alerts = buildSecurityAlerts(
+      [session({ current: true, loginAt: '2026-01-01T00:00:00.000Z' })],
+      { now }
+    )
+    expect(alerts).toHaveLength(0)
+  })
+
+  it('warns about a recent sign-in from another device', () => {
+    const alerts = buildSecurityAlerts(
+      [
+        session({
+          id: 1,
+          current: true,
+          ipAddress: '203.0.113.10',
+          loginAt: '2026-01-01T00:00:00.000Z',
+        }),
+        session({
+          id: 2,
+          ipAddress: '198.51.100.4',
+          loginAt: '2026-01-09T12:00:00.000Z',
+        }),
+      ],
+      { now }
+    )
+
+    expect(alerts.map((a) => a.id)).toContain('recent-sign-in')
+    expect(alerts.map((a) => a.id)).toContain('unfamiliar-network')
+    expect(
+      alerts.find((a) => a.id === 'unfamiliar-network')?.severity
+    ).toBe('critical')
+  })
+
+  it('reports a recent revocation', () => {
+    const alerts = buildSecurityAlerts(
+      [session({ status: 'revoked', revokedAt: '2026-01-08T00:00:00.000Z' })],
+      { now }
+    )
+    expect(alerts.map((a) => a.id)).toContain('recent-revocation')
+  })
+})
+
+describe('listSecuritySessions', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns grouped sessions and alerts', async () => {
+    const rows = [row({ id: 1, jti: 'a' })]
+    mockSql.mockResolvedValueOnce(rows)
+
+    const result = await listSecuritySessions('GWALLET', null)
+
+    expect(result.sessions).toHaveLength(1)
+    expect(result.sessions[0].id).toBe(1)
+    expect(Array.isArray(result.alerts)).toBe(true)
+  })
+})
+
+describe('revokeWalletSession', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns not_found when the session does not belong to the wallet', async () => {
+    mockSql.mockResolvedValueOnce([])
+    const result: RevokeSessionResult = await revokeWalletSession('GWALLET', 7)
+    expect(result).toBe('not_found')
+  })
+
+  it('revokes an owned active session', async () => {
+    mockSql.mockResolvedValueOnce([{ id: 7 }])
+    mockSql.mockResolvedValueOnce([{ id: 7 }])
+
+    const result = await revokeWalletSession('GWALLET', 7)
+    expect(result).toBe('revoked')
+  })
+
+  it('returns not_revocable when nothing was updated', async () => {
+    mockSql.mockResolvedValueOnce([{ id: 7 }])
+    mockSql.mockResolvedValueOnce([])
+
+    const result = await revokeWalletSession('GWALLET', 7)
+    expect(result).toBe('not_revocable')
+  })
+})
diff --git a/app/api/auth/sessions/[id]/revoke/route.ts b/app/api/auth/sessions/[id]/revoke/route.ts
new file mode 100644
index 0000000..bdb195e
--- /dev/null
+++ b/app/api/auth/sessions/[id]/revoke/route.ts
@@ -0,0 +1,75 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { withAuthCtx } from '@/lib/auth/middleware'
+import { revokeWalletSession } from '@/lib/auth/sessions'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
+
+/**
+ * POST /api/auth/sessions/[id]/revoke
+ *
+ * Revokes a single session belonging to the authenticated wallet. The client
+ * must only reflect the revocation in the UI after a 2xx response.
+ *
+ * Error codes:
+ * - 400 INVALID_SESSION_ID   – non-numeric / non-positive id
+ * - 404 SESSION_NOT_FOUND    – id does not belong to this wallet
+ * - 409 SESSION_NOT_REVOCABLE – already revoked/expired or a rotation record
+ * - 429 RATE_LIMITED
+ * - 500 SESSION_REVOKE_FAILED
+ */
+export const POST = withAuthCtx<{ params: Promise<{ id: string }> }>(
+  async (request: NextRequest, auth, context) => {
+    try {
+      const { id } = await context.params
+      const sessionId = Number(id)
+      if (!Number.isInteger(sessionId) || sessionId <= 0) {
+        return NextResponse.json(
+          { error: 'Session id must be a positive integer.', code: 'INVALID_SESSION_ID' },
+          { status: 400 }
+        )
+      }
+
+      const limited = await enforceRateLimit(request, {
+        key: buildRateLimitKey(
+          request,
+          'auth:sessions:revoke',
+          auth.walletAddress
+        ),
+        limit: 20,
+        windowMs: 60_000,
+      })
+      if (limited) return limited
+
+      const result = await revokeWalletSession(auth.walletAddress, sessionId)
+
+      if (result === 'not_found') {
+        return NextResponse.json(
+          { error: 'Session not found.', code: 'SESSION_NOT_FOUND' },
+          { status: 404 }
+        )
+      }
+
+      if (result === 'not_revocable') {
+        return NextResponse.json(
+          {
+            error: 'This session is no longer active and cannot be revoked.',
+            code: 'SESSION_NOT_REVOCABLE',
+          },
+          { status: 409 }
+        )
+      }
+
+      return NextResponse.json(
+        { data: { id: sessionId, status: 'revoked' } },
+        { status: 200, headers: { 'Cache-Control': 'private, no-store' } }
+      )
+    } catch (err) {
+      console.error('[POST /api/auth/sessions/[id]/revoke]', err)
+      return NextResponse.json(
+        { error: 'Failed to revoke session', code: 'SESSION_REVOKE_FAILED' },
+        { status: 500 }
+      )
+    }
+  }
+)
diff --git a/app/api/auth/sessions/route.ts b/app/api/auth/sessions/route.ts
new file mode 100644
index 0000000..525200e
--- /dev/null
+++ b/app/api/auth/sessions/route.ts
@@ -0,0 +1,47 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { withAuth } from '@/lib/auth/middleware'
+import { readRefreshToken } from '@/lib/auth/session'
+import { listSecuritySessions } from '@/lib/auth/sessions'
+import { enforceRateLimit, buildRateLimitKey } from '@/lib/security/rateLimit'
+
+/**
+ * GET /api/auth/sessions
+ *
+ * Returns the authenticated wallet's sessions (active, revoked and expired)
+ * plus derived security alerts.
+ *
+ * Security notes:
+ * - Scoped to `auth.walletAddress`; the client can never query another wallet.
+ * - Response contains only non-sensitive fields (never `jti`, `token_hash`).
+ * - The current session is flagged via the httpOnly refresh cookie, not via
+ *   an attacker-controllable query parameter.
+ */
+export const GET = withAuth(async (request: NextRequest, auth) => {
+  try {
+    const limited = await enforceRateLimit(request, {
+      key: buildRateLimitKey(request, 'auth:sessions:list', auth.walletAddress),
+      limit: 60,
+      windowMs: 60_000,
+    })
+    if (limited) return limited
+
+    const refreshToken = readRefreshToken(request)
+    const payload = await listSecuritySessions(auth.walletAddress, refreshToken)
+
+    return NextResponse.json(
+      { data: payload, meta: { generatedAt: new Date().toISOString() } },
+      {
+        status: 200,
+        headers: { 'Cache-Control': 'private, no-store' },
+      }
+    )
+  } catch (err) {
+    console.error('[GET /api/auth/sessions]', err)
+    return NextResponse.json(
+      { error: 'Failed to load sessions', code: 'SESSIONS_LOAD_FAILED' },
+      { status: 500 }
+    )
+  }
+})
diff --git a/app/dashboard/security/page.tsx b/app/dashboard/security/page.tsx
new file mode 100644
index 0000000..e49099b
--- /dev/null
+++ b/app/dashboard/security/page.tsx
@@ -0,0 +1,12 @@
+import type { Metadata } from 'next'
+import { SecurityDashboard } from './security-client'
+
+export const metadata: Metadata = {
+  title: 'Security | TaskChain',
+  description:
+    'Review account activity, monitor active sessions and manage who can access your TaskChain account.',
+}
+
+export default function SecurityPage() {
+  return <SecurityDashboard />
+}
diff --git a/app/dashboard/security/security-client.test.tsx b/app/dashboard/security/security-client.test.tsx
new file mode 100644
index 0000000..7edfb87
--- /dev/null
+++ b/app/dashboard/security/security-client.test.tsx
@@ -0,0 +1,199 @@
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { toastSuccess, toastError, pushMock } = vi.hoisted(() => ({
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  pushMock: vi.fn(),
+}))
+
+vi.mock('sonner', () => ({
+  toast: { success: toastSuccess, error: toastError },
+}))
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: pushMock }),
+}))
+
+vi.mock('@/components/wallet-provider', () => ({
+  useStellarWallet: () => ({
+    address: null,
+    network: 'UNKNOWN',
+    isWrongNetwork: false,
+    isConnecting: false,
+    connect: vi.fn(),
+  }),
+  truncateStellarAddress: (address: string) => address,
+  networkLabel: (network: string) => network,
+  REQUIRED_NETWORK: 'TESTNET',
+}))
+
+import { SecurityDashboard } from './security-client'
+
+const remoteSession = {
+  id: 1,
+  status: 'active' as const,
+  current: false,
+  device: {
+    browser: 'Chrome',
+    os: 'Windows',
+    type: 'desktop' as const,
+    label: 'Chrome on Windows',
+  },
+  ipAddress: '203.0.113.10',
+  loginAt: '2026-01-01T00:00:00.000Z',
+  lastActiveAt: '2026-01-02T00:00:00.000Z',
+  expiresAt: '2030-01-01T00:00:00.000Z',
+  revokedAt: null,
+}
+
+const currentSession = {
+  ...remoteSession,
+  id: 2,
+  current: true,
+  device: { ...remoteSession.device, label: 'Firefox on macOS' },
+  ipAddress: '203.0.113.10',
+}
+
+function mockSessionsFetch(
+  sessions: unknown[],
+  alerts: unknown[] = [],
+  revokeResponse: { ok: boolean; status?: number; body?: unknown } = {
+    ok: true,
+    body: { data: { id: 1, status: 'revoked' } },
+  }
+) {
+  const fetchMock = vi.fn((url: string, init?: RequestInit) => {
+    if (init?.method === 'POST' && url.includes('/revoke')) {
+      return Promise.resolve({
+        ok: revokeResponse.ok,
+        status: revokeResponse.status ?? (revokeResponse.ok ? 200 : 409),
+        json: async () =>
+          revokeResponse.body ?? { error: 'Failed to revoke session' },
+      }) as Promise<Response>
+    }
+
+    return Promise.resolve({
+      ok: true,
+      status: 200,
+      json: async () => ({ data: { sessions, alerts } }),
+    }) as Promise<Response>
+  })
+
+  vi.stubGlobal('fetch', fetchMock)
+  return fetchMock
+}
+
+describe('SecurityDashboard', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  afterEach(() => {
+    cleanup()
+    vi.unstubAllGlobals()
+    vi.restoreAllMocks()
+  })
+
+  it('renders sessions and distinguishes the current device', async () => {
+    mockSessionsFetch([remoteSession, currentSession])
+
+    render(<SecurityDashboard />)
+
+    expect(await screen.findByText('Chrome on Windows')).toBeInTheDocument()
+    expect(screen.getByText('Firefox on macOS')).toBeInTheDocument()
+    expect(screen.getAllByText('Active').length).toBeGreaterThanOrEqual(2)
+    expect(screen.getByText('This device')).toBeInTheDocument()
+  })
+
+  it('shows the empty state when there are no active sessions', async () => {
+    mockSessionsFetch([])
+    render(<SecurityDashboard />)
+    expect(await screen.findByText('No active sessions.')).toBeInTheDocument()
+  })
+
+  it('shows an error state and retries on failure', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(() =>
+        Promise.resolve({
+          ok: false,
+          status: 500,
+          json: async () => ({ error: 'Failed to load sessions' }),
+        }) as Promise<Response>
+      )
+    )
+
+    render(<SecurityDashboard />)
+
+    expect(
+      await screen.findByText('Failed to load sessions')
+    ).toBeInTheDocument()
+    expect(
+      screen.getByRole('button', { name: /try again/i })
+    ).toBeInTheDocument()
+  })
+
+  it('confirms before revoking and only then updates the UI', async () => {
+    const fetchMock = mockSessionsFetch([remoteSession, currentSession])
+
+    render(<SecurityDashboard />)
+
+    const revokeButton = await screen.findByRole('button', { name: 'Revoke' })
+    fireEvent.click(revokeButton)
+
+    // Confirmation dialog is shown and no request has been made yet.
+    expect(
+      await screen.findByText('Revoke this session?')
+    ).toBeInTheDocument()
+    expect(
+      fetchMock.mock.calls.some(([, init]) => init?.method === 'POST')
+    ).toBe(false)
+
+    fireEvent.click(screen.getByRole('button', { name: /revoke session/i }))
+
+    await waitFor(() => {
+      expect(toastSuccess).toHaveBeenCalledWith('Session revoked')
+    })
+
+    expect(
+      fetchMock.mock.calls.some(
+        ([url, init]) =>
+          init?.method === 'POST' && String(url).includes('/sessions/1/revoke')
+      )
+    ).toBe(true)
+
+    // The revoked session moves out of the active list.
+    expect(screen.queryByText('Chrome on Windows')).not.toBeInTheDocument()
+    expect(
+      screen.getByRole('tab', { name: /revoked \(1\)/i })
+    ).toBeInTheDocument()
+
+    // Radix tabs activate on mouseDown, not click.
+    fireEvent.mouseDown(screen.getByRole('tab', { name: /revoked \(1\)/i }))
+    expect(await screen.findByText('Chrome on Windows')).toBeInTheDocument()
+    expect(screen.getByText('Revoked')).toBeInTheDocument()
+  })
+
+  it('keeps the session active and surfaces an error when revocation fails', async () => {
+    mockSessionsFetch([remoteSession, currentSession], [], {
+      ok: false,
+      status: 409,
+      body: { error: 'This session is no longer active' },
+    })
+
+    render(<SecurityDashboard />)
+
+    fireEvent.click(await screen.findByRole('button', { name: 'Revoke' }))
+    fireEvent.click(screen.getByRole('button', { name: /revoke session/i }))
+
+    await waitFor(() => {
+      expect(toastError).toHaveBeenCalledWith(
+        'This session is no longer active'
+      )
+    })
+
+    // The dialog closes and the session is still listed as active.
+    expect(screen.queryByText('Revoked')).not.toBeInTheDocument()
+  })
+})
diff --git a/app/dashboard/security/security-client.tsx b/app/dashboard/security/security-client.tsx
new file mode 100644
index 0000000..1716511
--- /dev/null
+++ b/app/dashboard/security/security-client.tsx
@@ -0,0 +1,650 @@
+'use client'
+
+import { useCallback, useEffect, useState } from 'react'
+import { useRouter } from 'next/navigation'
+import {
+  AlertTriangle,
+  Check,
+  Copy,
+  Info,
+  Laptop,
+  Loader2,
+  MonitorSmartphone,
+  RefreshCw,
+  ShieldAlert,
+  ShieldCheck,
+  Smartphone,
+  Tablet,
+  Wallet,
+} from 'lucide-react'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/button'
+import { Badge } from '@/components/ui/badge'
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@/components/ui/card'
+import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs'
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@/components/ui/alert-dialog'
+import {
+  REQUIRED_NETWORK,
+  networkLabel,
+  truncateStellarAddress,
+  useStellarWallet,
+} from '@/components/wallet-provider'
+import { cn } from '@/lib/utils'
+import {
+  buildSecurityAlerts,
+  type SecurityAlert,
+  type SecuritySession,
+  type SessionDeviceType,
+  type SessionStatus,
+} from '@/lib/auth/session-types'
+
+function getAuthHeaders(): Record<string, string> {
+  const token =
+    typeof window !== 'undefined'
+      ? localStorage.getItem('tc_dev_access_token')
+      : null
+  return token ? { Authorization: `Bearer ${token}` } : {}
+}
+
+function formatDateTime(iso: string): string {
+  const date = new Date(iso)
+  return Number.isNaN(date.getTime()) ? 'Unknown time' : date.toLocaleString()
+}
+
+function formatRelative(iso: string): string {
+  const parsed = Date.parse(iso)
+  if (Number.isNaN(parsed)) return 'Unknown'
+
+  const diffMs = Date.now() - parsed
+  const diffSec = Math.floor(diffMs / 1000)
+  if (diffSec < 60) return 'just now'
+  const diffMin = Math.floor(diffSec / 60)
+  if (diffMin < 60) return `${diffMin}m ago`
+  const diffHour = Math.floor(diffMin / 60)
+  if (diffHour < 24) return `${diffHour}h ago`
+  const diffDay = Math.floor(diffHour / 24)
+  if (diffDay < 7) return `${diffDay}d ago`
+  return formatDateTime(iso)
+}
+
+const deviceIcons: Record<SessionDeviceType, typeof Laptop> = {
+  mobile: Smartphone,
+  tablet: Tablet,
+  desktop: Laptop,
+  unknown: MonitorSmartphone,
+}
+
+const alertStyles: Record<
+  SecurityAlert['severity'],
+  { container: string; icon: string; Icon: typeof ShieldAlert }
+> = {
+  critical: {
+    container: 'border-destructive/40 bg-destructive/10',
+    icon: 'text-destructive',
+    Icon: ShieldAlert,
+  },
+  warning: {
+    container: 'border-amber-500/40 bg-amber-500/10',
+    icon: 'text-amber-600 dark:text-amber-400',
+    Icon: AlertTriangle,
+  },
+  info: {
+    container: 'border-border/40 bg-card/50',
+    icon: 'text-primary',
+    Icon: Info,
+  },
+}
+
+function StatusBadge({ status }: { status: SessionStatus }) {
+  if (status === 'active') {
+    return <Badge variant="default">Active</Badge>
+  }
+  if (status === 'revoked') {
+    return <Badge variant="destructive">Revoked</Badge>
+  }
+  return <Badge variant="outline">Expired</Badge>
+}
+
+function SessionSkeleton() {
+  return (
+    <div className="space-y-3" aria-hidden="true">
+      {[0, 1, 2].map((item) => (
+        <div
+          key={item}
+          className="h-24 rounded-xl bg-card/50 border border-border/40 animate-pulse"
+        />
+      ))}
+    </div>
+  )
+}
+
+interface SessionCardProps {
+  session: SecuritySession
+  onRevoke: (session: SecuritySession) => void
+  onSignOut: (session: SecuritySession) => void
+}
+
+function SessionCard({ session, onRevoke, onSignOut }: SessionCardProps) {
+  const Icon = deviceIcons[session.device.type] ?? MonitorSmartphone
+
+  return (
+    <Card className="bg-card/50 backdrop-blur-sm border-border/40">
+      <CardContent className="p-4 sm:p-5 flex flex-col sm:flex-row sm:items-center gap-4">
+        <div className="flex items-start gap-3 flex-1 min-w-0">
+          <div className="h-10 w-10 rounded-lg bg-primary/10 flex items-center justify-center shrink-0">
+            <Icon className="h-5 w-5 text-primary" aria-hidden="true" />
+          </div>
+          <div className="min-w-0 space-y-1">
+            <div className="flex flex-wrap items-center gap-2">
+              <p className="font-medium text-sm">{session.device.label}</p>
+              {session.current ? (
+                <Badge variant="secondary">This device</Badge>
+              ) : null}
+            </div>
+            <p className="text-xs text-muted-foreground">
+              {session.ipAddress ?? 'Unknown IP'} · Signed in{' '}
+              {formatDateTime(session.loginAt)}
+            </p>
+            <p className="text-xs text-muted-foreground">
+              Last active {formatRelative(session.lastActiveAt)}
+              {session.status === 'expired'
+                ? ` · Expired ${formatRelative(session.expiresAt)}`
+                : null}
+            </p>
+          </div>
+        </div>
+        <div className="flex items-center gap-2 sm:flex-col sm:items-end shrink-0">
+          <StatusBadge status={session.status} />
+          {session.status === 'active' ? (
+            session.current ? (
+              <Button size="sm" variant="outline" onClick={() => onSignOut(session)}>
+                Sign out
+              </Button>
+            ) : (
+              <Button
+                size="sm"
+                variant="destructive"
+                onClick={() => onRevoke(session)}
+              >
+                Revoke
+              </Button>
+            )
+          ) : null}
+        </div>
+      </CardContent>
+    </Card>
+  )
+}
+
+interface SessionListProps {
+  sessions: SecuritySession[]
+  emptyMessage: string
+  onRevoke: (session: SecuritySession) => void
+  onSignOut: (session: SecuritySession) => void
+}
+
+function SessionList({
+  sessions,
+  emptyMessage,
+  onRevoke,
+  onSignOut,
+}: SessionListProps) {
+  if (sessions.length === 0) {
+    return (
+      <div className="text-center py-12 text-muted-foreground text-sm">
+        {emptyMessage}
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-3">
+      {sessions.map((session) => (
+        <SessionCard
+          key={session.id}
+          session={session}
+          onRevoke={onRevoke}
+          onSignOut={onSignOut}
+        />
+      ))}
+    </div>
+  )
+}
+
+export function SecurityDashboard() {
+  const router = useRouter()
+  const {
+    address,
+    network,
+    isWrongNetwork,
+    isConnecting,
+    connect,
+  } = useStellarWallet()
+
+  const [sessions, setSessions] = useState<SecuritySession[]>([])
+  const [alerts, setAlerts] = useState<SecurityAlert[]>([])
+  const [isLoading, setIsLoading] = useState(true)
+  const [error, setError] = useState<string | null>(null)
+  const [pendingSession, setPendingSession] = useState<SecuritySession | null>(
+    null
+  )
+  const [pendingAction, setPendingAction] = useState<'revoke' | 'logout'>(
+    'revoke'
+  )
+  const [isSubmitting, setIsSubmitting] = useState(false)
+  const [copied, setCopied] = useState(false)
+  const [tab, setTab] = useState<SessionStatus | 'history'>('active')
+
+  const loadSessions = useCallback(async () => {
+    setIsLoading(true)
+    setError(null)
+    try {
+      const response = await fetch('/api/auth/sessions', {
+        method: 'GET',
+        headers: getAuthHeaders(),
+        credentials: 'include',
+      })
+
+      if (!response.ok) {
+        const body = await response.json().catch(() => null)
+        throw new Error(body?.error ?? 'Failed to load sessions')
+      }
+
+      const body = await response.json()
+      setSessions(body.data.sessions ?? [])
+      setAlerts(body.data.alerts ?? [])
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'Something went wrong')
+    } finally {
+      setIsLoading(false)
+    }
+  }, [])
+
+  useEffect(() => {
+    void loadSessions()
+  }, [loadSessions])
+
+  const handleRevoke = useCallback((session: SecuritySession) => {
+    setPendingAction('revoke')
+    setPendingSession(session)
+  }, [])
+
+  const handleSignOut = useCallback((session: SecuritySession) => {
+    setPendingAction('logout')
+    setPendingSession(session)
+  }, [])
+
+  const handleConfirm = useCallback(async () => {
+    const target = pendingSession
+    if (!target) return
+
+    setIsSubmitting(true)
+    try {
+      if (pendingAction === 'logout') {
+        const response = await fetch('/api/auth/logout', {
+          method: 'POST',
+          headers: getAuthHeaders(),
+          credentials: 'include',
+        })
+        if (!response.ok) {
+          const body = await response.json().catch(() => null)
+          throw new Error(body?.error ?? 'Failed to sign out')
+        }
+        localStorage.removeItem('tc_dev_access_token')
+        toast.success('Signed out of this device')
+        setPendingSession(null)
+        router.push('/login')
+        return
+      }
+
+      // Only reflect the revocation after the server confirms it.
+      const response = await fetch(
+        `/api/auth/sessions/${target.id}/revoke`,
+        {
+          method: 'POST',
+          headers: getAuthHeaders(),
+          credentials: 'include',
+        }
+      )
+      const body = await response.json().catch(() => null)
+      if (!response.ok) {
+        throw new Error(body?.error ?? 'Failed to revoke session')
+      }
+
+      const next = sessions.map((session) =>
+        session.id === target.id
+          ? {
+              ...session,
+              status: 'revoked' as SessionStatus,
+              revokedAt: new Date().toISOString(),
+            }
+          : session
+      )
+      setSessions(next)
+      setAlerts(buildSecurityAlerts(next))
+      toast.success('Session revoked')
+      setPendingSession(null)
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Something went wrong')
+      setPendingSession(null)
+    } finally {
+      setIsSubmitting(false)
+    }
+  }, [pendingAction, pendingSession, router, sessions])
+
+  const handleCopyAddress = useCallback(async () => {
+    if (!address) return
+    try {
+      await navigator.clipboard.writeText(address)
+      setCopied(true)
+      toast.success('Wallet address copied')
+      setTimeout(() => setCopied(false), 2000)
+    } catch {
+      toast.error('Failed to copy wallet address')
+    }
+  }, [address])
+
+  const activeSessions = sessions.filter((s) => s.status === 'active')
+  const revokedSessions = sessions.filter((s) => s.status === 'revoked')
+  const expiredSessions = sessions.filter((s) => s.status === 'expired')
+  const loginHistory = [...sessions].sort(
+    (a, b) => Date.parse(b.loginAt) - Date.parse(a.loginAt)
+  )
+
+  const openRevokeDialog = pendingAction === 'revoke'
+
+  return (
+    <div className="p-4 sm:p-6 lg:p-8">
+      <div className="space-y-8 max-w-5xl mx-auto">
+        <div className="flex flex-col sm:flex-row sm:items-center justify-between gap-4">
+          <div>
+            <h1 className="text-2xl sm:text-3xl font-bold flex items-center gap-2">
+              <ShieldCheck className="h-7 w-7 text-primary" aria-hidden="true" />
+              Account Security
+            </h1>
+            <p className="text-muted-foreground mt-2">
+              Review your sessions, watch for suspicious activity and manage
+              who can access your account.
+            </p>
+          </div>
+          <Button
+            variant="outline"
+            size="sm"
+            onClick={() => void loadSessions()}
+            disabled={isLoading}
+          >
+            <RefreshCw
+              className={cn('h-4 w-4 mr-2', isLoading && 'animate-spin')}
+              aria-hidden="true"
+            />
+            Refresh
+          </Button>
+        </div>
+
+        {/* Wallet & network */}
+        <Card className="bg-card/50 backdrop-blur-sm border-border/40">
+          <CardHeader>
+            <CardTitle className="flex items-center gap-2">
+              <Wallet className="h-5 w-5" aria-hidden="true" />
+              Connected wallet
+            </CardTitle>
+            <CardDescription>
+              The wallet and network used to sign in to TaskChain.
+            </CardDescription>
+          </CardHeader>
+          <CardContent>
+            {!address ? (
+              <div className="flex flex-col sm:flex-row sm:items-center gap-3">
+                <p className="text-sm text-muted-foreground flex-1">
+                  No wallet connected. Connect Freighter to see your wallet
+                  address and network.
+                </p>
+                <Button
+                  size="sm"
+                  onClick={() => void connect()}
+                  disabled={isConnecting}
+                >
+                  {isConnecting ? (
+                    <>
+                      <Loader2
+                        className="h-4 w-4 mr-2 animate-spin"
+                        aria-hidden="true"
+                      />
+                      Connecting…
+                    </>
+                  ) : (
+                    'Connect wallet'
+                  )}
+                </Button>
+              </div>
+            ) : (
+              <div className="grid gap-4 sm:grid-cols-2">
+                <div>
+                  <p className="text-xs text-muted-foreground">Wallet address</p>
+                  <div className="mt-1 flex items-center gap-2">
+                    <code className="text-sm font-mono truncate">
+                      {truncateStellarAddress(address)}
+                    </code>
+                    <Button
+                      variant="ghost"
+                      size="icon-sm"
+                      onClick={() => void handleCopyAddress()}
+                      aria-label="Copy wallet address"
+                    >
+                      {copied ? (
+                        <Check
+                          className="h-4 w-4 text-green-500"
+                          aria-hidden="true"
+                        />
+                      ) : (
+                        <Copy className="h-4 w-4" aria-hidden="true" />
+                      )}
+                    </Button>
+                  </div>
+                </div>
+                <div>
+                  <p className="text-xs text-muted-foreground">Network</p>
+                  <div className="mt-1 flex flex-wrap items-center gap-2">
+                    <Badge
+                      variant={
+                        network === REQUIRED_NETWORK ? 'secondary' : 'destructive'
+                      }
+                    >
+                      {networkLabel(network)}
+                    </Badge>
+                    {isWrongNetwork ? (
+                      <span className="text-xs text-destructive">
+                        Expected {networkLabel(REQUIRED_NETWORK)}
+                      </span>
+                    ) : null}
+                  </div>
+                </div>
+              </div>
+            )}
+          </CardContent>
+        </Card>
+
+        {/* Security alerts */}
+        {alerts.length > 0 ? (
+          <section aria-label="Security alerts" className="space-y-3">
+            <h2 className="text-lg font-semibold">Security alerts</h2>
+            <div className="space-y-3">
+              {alerts.map((alert) => {
+                const styles = alertStyles[alert.severity]
+                const Icon = styles.Icon
+                return (
+                  <div
+                    key={alert.id}
+                    role="alert"
+                    className={cn(
+                      'flex items-start gap-3 rounded-xl border p-4',
+                      styles.container
+                    )}
+                  >
+                    <Icon
+                      className={cn('h-5 w-5 shrink-0 mt-0.5', styles.icon)}
+                      aria-hidden="true"
+                    />
+                    <div className="min-w-0">
+                      <p className="text-sm font-medium">{alert.title}</p>
+                      <p className="text-sm text-muted-foreground mt-1">
+                        {alert.message}
+                      </p>
+                    </div>
+                  </div>
+                )
+              })}
+            </div>
+          </section>
+        ) : null}
+
+        {/* Sessions */}
+        <section aria-label="Sessions" className="space-y-4">
+          <div>
+            <h2 className="text-lg font-semibold">Sessions</h2>
+            <p className="text-sm text-muted-foreground mt-1">
+              Devices that are signed in or have signed in to your account.
+              Revoke anything you do not recognise.
+            </p>
+          </div>
+
+          {isLoading && sessions.length === 0 ? (
+            <SessionSkeleton />
+          ) : error ? (
+            <div
+              role="alert"
+              className="text-center py-12 rounded-xl border border-destructive/40 bg-destructive/10"
+            >
+              <p className="text-sm text-muted-foreground">{error}</p>
+              <Button
+                variant="outline"
+                size="sm"
+                className="mt-4"
+                onClick={() => void loadSessions()}
+              >
+                Try again
+              </Button>
+            </div>
+          ) : (
+            <Tabs
+              value={tab}
+              onValueChange={(value) =>
+                setTab(value as SessionStatus | 'history')
+              }
+            >
+              <div className="overflow-x-auto">
+                <TabsList className="h-auto">
+                  <TabsTrigger value="active" className="whitespace-nowrap">
+                    Active ({activeSessions.length})
+                  </TabsTrigger>
+                  <TabsTrigger value="revoked" className="whitespace-nowrap">
+                    Revoked ({revokedSessions.length})
+                  </TabsTrigger>
+                  <TabsTrigger value="expired" className="whitespace-nowrap">
+                    Expired ({expiredSessions.length})
+                  </TabsTrigger>
+                  <TabsTrigger value="history" className="whitespace-nowrap">
+                    Login history
+                  </TabsTrigger>
+                </TabsList>
+              </div>
+
+              <TabsContent value="active" className="mt-4">
+                <SessionList
+                  sessions={activeSessions}
+                  emptyMessage="No active sessions."
+                  onRevoke={handleRevoke}
+                  onSignOut={handleSignOut}
+                />
+              </TabsContent>
+              <TabsContent value="revoked" className="mt-4">
+                <SessionList
+                  sessions={revokedSessions}
+                  emptyMessage="No revoked sessions."
+                  onRevoke={handleRevoke}
+                  onSignOut={handleSignOut}
+                />
+              </TabsContent>
+              <TabsContent value="expired" className="mt-4">
+                <SessionList
+                  sessions={expiredSessions}
+                  emptyMessage="No expired sessions."
+                  onRevoke={handleRevoke}
+                  onSignOut={handleSignOut}
+                />
+              </TabsContent>
+              <TabsContent value="history" className="mt-4">
+                <SessionList
+                  sessions={loginHistory}
+                  emptyMessage="No sign-in activity yet."
+                  onRevoke={handleRevoke}
+                  onSignOut={handleSignOut}
+                />
+              </TabsContent>
+            </Tabs>
+          )}
+        </section>
+      </div>
+
+      {/* Revoke / sign-out confirmation */}
+      <AlertDialog
+        open={!!pendingSession}
+        onOpenChange={(open) => {
+          if (!open && !isSubmitting) setPendingSession(null)
+        }}
+      >
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {openRevokeDialog ? 'Revoke this session?' : 'Sign out this device?'}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {openRevokeDialog
+                ? `"${pendingSession?.device.label ?? 'This session'}" will be signed out immediately and will need to sign in again.`
+                : 'You will be signed out of TaskChain on this device and redirected to the login page.'}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel disabled={isSubmitting}>Cancel</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={(event) => {
+                event.preventDefault()
+                void handleConfirm()
+              }}
+              disabled={isSubmitting}
+            >
+              {isSubmitting ? (
+                <>
+                  <Loader2
+                    className="h-4 w-4 mr-2 animate-spin"
+                    aria-hidden="true"
+                  />
+                  Working…
+                </>
+              ) : openRevokeDialog ? (
+                'Revoke session'
+              ) : (
+                'Sign out'
+              )}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  )
+}
diff --git a/components/dashboard/sidebar.tsx b/components/dashboard/sidebar.tsx
index 0e16e04..dd0e797 100644
--- a/components/dashboard/sidebar.tsx
+++ b/components/dashboard/sidebar.tsx
@@ -13,6 +13,7 @@ import {
   Settings,
   MessageSquare,
   Banknote,
+  ShieldCheck,
 } from 'lucide-react'
 import { Button } from '@/components/ui/button'
 import { cn } from '@/lib/utils'
@@ -58,6 +59,11 @@ const navItems = [
     href: '/dashboard/profile',
     icon: UserCircle,
   },
+  {
+    label: 'Security',
+    href: '/dashboard/security',
+    icon: ShieldCheck,
+  },
   {
     label: 'Settings',
     href: '/settings',
diff --git a/lib/auth/session-types.ts b/lib/auth/session-types.ts
new file mode 100644
index 0000000..bc7ebc9
--- /dev/null
+++ b/lib/auth/session-types.ts
@@ -0,0 +1,208 @@
+/**
+ * Client-safe session types and pure helpers for the Account Security
+ * dashboard.
+ *
+ * This module deliberately contains **no server-only imports** (no `@/lib/db`,
+ * no Node built-ins) so it can be shared by API routes, the dashboard client
+ * component, and unit tests.
+ *
+ * Sensitive token material (`jti`, `token_hash`, raw wallet address) is never
+ * represented here; only the human-readable fields a user is allowed to see.
+ */
+
+export type SessionStatus = 'active' | 'revoked' | 'expired'
+
+export type SessionDeviceType = 'mobile' | 'tablet' | 'desktop' | 'unknown'
+
+export interface SessionDevice {
+  /** Browser name, e.g. "Chrome". */
+  browser: string
+  /** Operating system, e.g. "Windows". */
+  os: string
+  /** Coarse device class derived from the user agent. */
+  type: SessionDeviceType
+  /** Human-readable summary, e.g. "Chrome on Windows". */
+  label: string
+}
+
+export interface SecuritySession {
+  /** Opaque, non-sensitive database identifier used to revoke the session. */
+  id: number
+  status: SessionStatus
+  /** True for the session that issued the current browser request. */
+  current: boolean
+  /** Device that most recently used the session. */
+  device: SessionDevice
+  /** IP address of the most recent request (may be null). */
+  ipAddress: string | null
+  /** When this session was first created (i.e. the login event). */
+  loginAt: string
+  /** When the session was last used (falls back to login time). */
+  lastActiveAt: string
+  /** When the refresh token expires. */
+  expiresAt: string
+  /** When the session was explicitly revoked, if applicable. */
+  revokedAt: string | null
+}
+
+export type SecurityAlertSeverity = 'info' | 'warning' | 'critical'
+
+export interface SecurityAlert {
+  id: string
+  severity: SecurityAlertSeverity
+  title: string
+  message: string
+}
+
+export interface SecuritySessionsPayload {
+  sessions: SecuritySession[]
+  alerts: SecurityAlert[]
+}
+
+const DAY_MS = 24 * 60 * 60 * 1000
+
+function detectBrowser(ua: string): string {
+  if (/edg\//i.test(ua)) return 'Edge'
+  if (/opr\//i.test(ua) || /opera/i.test(ua)) return 'Opera'
+  if (/chrome\/crios/i.test(ua)) return 'Chrome'
+  if (/chrome\//i.test(ua)) return 'Chrome'
+  if (/firefox\/|fxios/i.test(ua)) return 'Firefox'
+  if (/safari\//i.test(ua)) return 'Safari'
+  return 'Unknown browser'
+}
+
+function detectOs(ua: string): string {
+  if (/windows/i.test(ua)) return 'Windows'
+  if (/iphone|ipad|ipod/i.test(ua)) return 'iOS'
+  if (/android/i.test(ua)) return 'Android'
+  if (/mac os x|macintosh/i.test(ua)) return 'macOS'
+  if (/linux/i.test(ua)) return 'Linux'
+  return 'Unknown OS'
+}
+
+function detectDeviceType(ua: string): SessionDeviceType {
+  if (/ipad|tablet/i.test(ua)) return 'tablet'
+  if (/mobi|iphone|ipod|android.*mobile|windows phone/i.test(ua)) return 'mobile'
+  if (/android/i.test(ua)) return 'tablet'
+  if (/windows|mac os x|macintosh|linux|cros/i.test(ua)) return 'desktop'
+  return 'unknown'
+}
+
+/**
+ * Best-effort, dependency-free user-agent parser. Returns a safe
+ * "Unknown device" descriptor when the user agent is missing or unparseable
+ * (never throws).
+ */
+export function parseUserAgent(userAgent: string | null | undefined): SessionDevice {
+  const ua = (userAgent ?? '').trim()
+  if (!ua) {
+    return {
+      browser: 'Unknown browser',
+      os: 'Unknown OS',
+      type: 'unknown',
+      label: 'Unknown device',
+    }
+  }
+
+  const browser = detectBrowser(ua)
+  const os = detectOs(ua)
+  const type = detectDeviceType(ua)
+
+  return {
+    browser,
+    os,
+    type,
+    label: `${browser} on ${os}`,
+  }
+}
+
+function parseTime(value: string | null | undefined): number | null {
+  if (!value) return null
+  const time = Date.parse(value)
+  return Number.isNaN(time) ? null : time
+}
+
+/**
+ * Derives non-blocking security warnings from the user's session list.
+ *
+ * Heuristics (all purely local, no external geo/IP intelligence):
+ * - recent sign-ins from devices other than this one
+ * - active sessions observed from an IP different to the current device
+ * - active sessions spread across more than one network
+ * - a session revoked within the last week (possible compromise follow-up)
+ */
+export function buildSecurityAlerts(
+  sessions: SecuritySession[],
+  options: { now?: number } = {}
+): SecurityAlert[] {
+  const now = options.now ?? Date.now()
+  const alerts: SecurityAlert[] = []
+
+  const current = sessions.find((session) => session.current) ?? null
+  const active = sessions.filter((session) => session.status === 'active')
+  const otherActive = active.filter((session) => session.id !== current?.id)
+
+  const recentSignIns = otherActive.filter((session) => {
+    const created = parseTime(session.loginAt)
+    return created !== null && now - created <= 2 * DAY_MS
+  })
+
+  if (recentSignIns.length > 0) {
+    alerts.push({
+      id: 'recent-sign-in',
+      severity: 'warning',
+      title: 'New sign-in detected',
+      message:
+        recentSignIns.length === 1
+          ? 'A session was started in the last 48 hours. If this was not you, revoke it immediately.'
+          : `${recentSignIns.length} sessions were started in the last 48 hours. If any of these were not you, revoke them immediately.`,
+    })
+  }
+
+  const unfamiliar = current?.ipAddress
+    ? otherActive.filter(
+        (session) =>
+          session.ipAddress !== null && session.ipAddress !== current.ipAddress
+      )
+    : []
+
+  if (unfamiliar.length > 0) {
+    alerts.push({
+      id: 'unfamiliar-network',
+      severity: 'critical',
+      title: 'Unfamiliar network activity',
+      message:
+        'An active session is connected from a different network than this device. Review and revoke any session you do not recognise.',
+    })
+  } else {
+    const distinctIps = new Set(
+      active.map((session) => session.ipAddress).filter((ip): ip is string => !!ip)
+    )
+    if (distinctIps.size > 1) {
+      alerts.push({
+        id: 'multiple-networks',
+        severity: 'warning',
+        title: 'Sessions from multiple networks',
+        message:
+          'Your active sessions originate from more than one network. Confirm that every device listed below belongs to you.',
+      })
+    }
+  }
+
+  const recentlyRevoked = sessions.filter((session) => {
+    const revoked = parseTime(session.revokedAt)
+    return revoked !== null && now - revoked <= 7 * DAY_MS
+  })
+
+  if (recentlyRevoked.length > 0) {
+    alerts.push({
+      id: 'recent-revocation',
+      severity: 'info',
+      title: 'A session was revoked recently',
+      message:
+        'A session was revoked in the last 7 days. If you did not perform this action, review your remaining sessions and sign out of any you do not recognise.',
+    })
+  }
+
+  return alerts
+}
diff --git a/lib/auth/sessions.ts b/lib/auth/sessions.ts
new file mode 100644
index 0000000..6d5f08c
--- /dev/null
+++ b/lib/auth/sessions.ts
@@ -0,0 +1,231 @@
+import { sha256Hex } from '@/lib/auth/crypto'
+import { sql } from '@/lib/db'
+import {
+  buildSecurityAlerts,
+  parseUserAgent,
+  type SecuritySession,
+  type SecuritySessionsPayload,
+  type SessionStatus,
+} from '@/lib/auth/session-types'
+
+/**
+ * Server-side data access for the Account Security dashboard.
+ *
+ * Sessions are derived from the `auth_refresh_tokens` table, which stores one
+ * row per issued refresh token. Because refresh tokens are rotated on every
+ * use, a single logical login produces a *chain* of rows linked through
+ * `replaced_by_jti`:
+ *
+ *   login row  ->  rotation row  ->  rotation row (tip)
+ *
+ * We collapse each chain back into one user-facing "session" whose identity is
+ * the chain root (the original login). Rotation intermediates are never
+ * surfaced, so the UI does not show a flood of "revoked" rows produced by
+ * normal token rotation.
+ *
+ * Only non-sensitive columns are selected for the API response. `jti` and
+ * `token_hash` are read internally for grouping but are never returned.
+ */
+
+export type RevokeSessionResult = 'revoked' | 'not_found' | 'not_revocable'
+
+interface SessionRow {
+  id: number | string
+  jti: string
+  user_agent: string | null
+  ip_address: string | null
+  created_at: string | Date
+  last_used_at: string | Date | null
+  expires_at: string | Date
+  revoked_at: string | Date | null
+  replaced_by_jti: string | null
+}
+
+/** Maximum number of raw token rows fetched per wallet. */
+const MAX_SESSION_ROWS = 200
+
+function toIso(value: string | Date | null | undefined): string | null {
+  if (value === null || value === undefined) return null
+  if (value instanceof Date) return value.toISOString()
+  const parsed = Date.parse(value)
+  return Number.isNaN(parsed) ? null : new Date(parsed).toISOString()
+}
+
+function statusOf(tip: SessionRow, now: number): SessionStatus {
+  if (tip.revoked_at) return 'revoked'
+  const expiresAt = toIso(tip.expires_at)
+  if (expiresAt === null || Date.parse(expiresAt) <= now) return 'expired'
+  return 'active'
+}
+
+/**
+ * Groups raw token rows into logical sessions. Exported for unit testing so
+ * the chain-collapsing behaviour can be verified without a database.
+ */
+export function groupSessionRows(
+  rows: SessionRow[],
+  options: { currentJti?: string | null; now?: number } = {}
+): SecuritySession[] {
+  const now = options.now ?? Date.now()
+
+  const byJti = new Map<string, SessionRow>()
+  const replacedJtis = new Set<string>()
+  const predecessorByJti = new Map<string, SessionRow>()
+
+  for (const row of rows) {
+    byJti.set(row.jti, row)
+    if (row.replaced_by_jti) {
+      replacedJtis.add(row.replaced_by_jti)
+      predecessorByJti.set(row.replaced_by_jti, row)
+    }
+  }
+
+  const rootOf = (row: SessionRow): SessionRow => {
+    let current = row
+    const seen = new Set<string>()
+    while (predecessorByJti.has(current.jti) && !seen.has(current.jti)) {
+      seen.add(current.jti)
+      current = predecessorByJti.get(current.jti) as SessionRow
+    }
+    return current
+  }
+
+  let currentRootId: string | null = null
+  if (options.currentJti && byJti.has(options.currentJti)) {
+    currentRootId = String(rootOf(byJti.get(options.currentJti) as SessionRow).id)
+  }
+
+  // Roots are rows that were not produced by a rotation.
+  const roots = rows.filter((row) => !replacedJtis.has(row.jti))
+
+  const sessions: SecuritySession[] = roots.map((root) => {
+    let tip = root
+    const seen = new Set<string>()
+    while (
+      tip.replaced_by_jti &&
+      byJti.has(tip.replaced_by_jti) &&
+      !seen.has(tip.jti)
+    ) {
+      seen.add(tip.jti)
+      tip = byJti.get(tip.replaced_by_jti) as SessionRow
+    }
+
+    const loginAt = toIso(root.created_at) ?? new Date(now).toISOString()
+    const lastActiveAt =
+      toIso(tip.last_used_at) ?? toIso(tip.created_at) ?? loginAt
+
+    return {
+      id: Number(root.id),
+      status: statusOf(tip, now),
+      current: currentRootId !== null && String(root.id) === currentRootId,
+      device: parseUserAgent(tip.user_agent),
+      ipAddress: tip.ip_address,
+      loginAt,
+      lastActiveAt,
+      expiresAt: toIso(tip.expires_at) ?? loginAt,
+      revokedAt: toIso(tip.revoked_at),
+    }
+  })
+
+  return sessions.sort((a, b) => {
+    const aTime = Date.parse(a.loginAt)
+    const bTime = Date.parse(b.loginAt)
+    return bTime - aTime
+  })
+}
+
+async function fetchSessionRows(walletAddress: string): Promise<SessionRow[]> {
+  const rows = await sql`
+    SELECT
+      id,
+      jti,
+      user_agent,
+      ip_address,
+      created_at,
+      last_used_at,
+      expires_at,
+      revoked_at,
+      replaced_by_jti
+    FROM auth_refresh_tokens
+    WHERE wallet_address = ${walletAddress}
+    ORDER BY created_at DESC
+    LIMIT ${MAX_SESSION_ROWS}
+  `
+
+  return rows as unknown as SessionRow[]
+}
+
+async function resolveCurrentJti(
+  walletAddress: string,
+  refreshToken: string | null
+): Promise<string | null> {
+  if (!refreshToken) return null
+
+  const rows = await sql`
+    SELECT jti
+    FROM auth_refresh_tokens
+    WHERE wallet_address = ${walletAddress}
+      AND token_hash = ${sha256Hex(refreshToken)}
+      AND revoked_at IS NULL
+    ORDER BY created_at DESC
+    LIMIT 1
+  `
+
+  return (rows as unknown as { jti: string }[])[0]?.jti ?? null
+}
+
+/**
+ * Returns every logical session for the wallet (active, revoked and expired)
+ * together with derived security alerts.
+ */
+export async function listSecuritySessions(
+  walletAddress: string,
+  refreshToken: string | null = null
+): Promise<SecuritySessionsPayload> {
+  const [rows, currentJti] = await Promise.all([
+    fetchSessionRows(walletAddress),
+    resolveCurrentJti(walletAddress, refreshToken),
+  ])
+
+  const sessions = groupSessionRows(rows, { currentJti })
+  const alerts = buildSecurityAlerts(sessions)
+
+  return { sessions, alerts }
+}
+
+/**
+ * Revokes a single session scoped to the authenticated wallet.
+ *
+ * Only the *tip* of an active chain can be revoked: rotation intermediates are
+ * already invalid and expired sessions are no-ops. The `wallet_address` guard
+ * prevents a user from revoking another wallet's session (IDOR).
+ */
+export async function revokeWalletSession(
+  walletAddress: string,
+  sessionId: number
+): Promise<RevokeSessionResult> {
+  const owned = await sql`
+    SELECT id
+    FROM auth_refresh_tokens
+    WHERE id = ${sessionId}
+      AND wallet_address = ${walletAddress}
+    LIMIT 1
+  `
+
+  if ((owned as unknown as unknown[]).length === 0) {
+    return 'not_found'
+  }
+
+  const revoked = await sql`
+    UPDATE auth_refresh_tokens
+    SET revoked_at = NOW()
+    WHERE id = ${sessionId}
+      AND wallet_address = ${walletAddress}
+      AND revoked_at IS NULL
+      AND replaced_by_jti IS NULL
+      AND expires_at > NOW()
+    RETURNING id
+  `
+
+  return (revoked as unknown as unknown[]).length > 0 ? 'revoked' : 'not_revocable'
+}
diff --git a/lib/db/migrations/011_session_history_index.sql b/lib/db/migrations/011_session_history_index.sql
new file mode 100644
index 0000000..fc2e38f
--- /dev/null
+++ b/lib/db/migrations/011_session_history_index.sql
@@ -0,0 +1,10 @@
+-- 011_session_history_index.sql
+--
+-- The Account Security dashboard lists a wallet's sessions (active, revoked
+-- and expired) ordered by creation time so it can also present login history.
+-- The existing index only covers *active* tokens (WHERE revoked_at IS NULL),
+-- so add a full per-wallet index to keep the history query indexed for
+-- accounts with many rotated / revoked tokens.
+
+CREATE INDEX IF NOT EXISTS idx_auth_refresh_tokens_wallet_created_at
+  ON auth_refresh_tokens (wallet_address, created_at DESC);