Athena is Northeastern Electric Racing's internal chatbot. It is not a product with outside users, so there is no advisory process — report anything you find to the Chief Software Engineer directly, not in a public GitHub issue.
Athena is a fork of Onyx from commit
3f11d9e, and most of the tree is still upstream's. Check whether the bug
reproduces on stock Onyx before reporting it there — NER's own changes are
small and listed by git log --oneline upstream/main..HEAD. If it is upstream's
bug, report it upstream; if it is in our diff, it is ours.
These are accepted, documented conditions of the current deployment — not undiscovered problems. All of them must be resolved before Athena is reachable by anyone outside the machine it runs on.
- Registration is open. Anyone who can reach the port can create an account.
Invite-only is off by default; turn it on at
/admin/security. - Credentials are plaintext in Postgres. Database access equals Confluence
credential access. Encryption-at-rest is available in this fork
(
backend/ee/onyx/utils/encryption.py, loaded by default) but is unused, becauseENCRYPTION_KEY_SECRETis unset. Setting it on a populated database requires re-encrypting existing rows — seebackend/scripts/reencrypt_secrets.py. - No per-user document permissions, by design. Every authenticated member sees everything Athena can see, so the account list is the access-control list. Offboarding graduated members matters.
- The sandboxed code interpreter is enabled. Confirm its isolation and network egress before wider access.
- Upstream security patches are not automatic. Onyx fixes vulnerabilities in
code we run, but those fixes only arrive when someone merges
upstream/main. Nobody owns that cadence yet.
Contact the Chief Software Engineer, or open a private issue in the Northeastern-Electric-Racing org. Include what you did, what happened, and what you expected.