Account

ATHELOS is single-user by design. There is one owner account. This page covers managing it.

Accessing account settings

Go to Settings in the sidebar, then Account.

Three sections:

• Profile — your name, email, and display preferences
• Password — change your login password
• Sessions — active sessions and sign-out controls

Profile

The profile section shows:

• Name — your display name, used in signatures and reports
• Email — your login email
• Timezone — affects how dates display

To change your name: edit the field, click Save. The change takes effect immediately — the topbar updates on next render.

To change your email: see the email section below.

Changing your email

Email changes are protected — they affect login. From the profile section:

1. Enter your new email
2. Enter your current password
3. Click Change email

The change is applied immediately. Your next login uses the new address.

If you have TOTP enabled, it stays enabled. Recovery codes stay valid. Only the login identifier changes.

Changing your password

From the password section:

1. Enter your current password
2. Enter the new password
3. Confirm the new password
4. Click Change password

Password requirements:

• Minimum 8 characters
• No maximum
• Any characters allowed

Strength is not enforced beyond length, but use a strong password. Consider a password manager or a generated passphrase.

Changing your password invalidates all other sessions. You'll stay signed in on the current session; every other session is terminated. This is intentional — if your password leaked, you want to boot anyone using it.

Sessions

The sessions section lists every active session:

• Device — user agent string parsed to a friendly label
• IP address — where the session originated
• Created — when the session began
• Last seen — most recent activity
• Current — badge on the session you're using right now

You can:

• Sign out individual sessions — click the sign-out icon on a row
• Sign out all other sessions — one button at the top

Useful if you've logged in on a device you no longer trust, or if you suspect a session was hijacked.

Session duration

Sessions last 30 days from creation. After 30 days, you're asked to sign in again.

Active sessions are extended on each use — if you're signing in daily, your session stays valid.

Idle sessions expire after 30 days of no activity.

Sign out

The sign-out button in the topbar ends the current session. You're redirected to the login page.

To sign out everywhere, use Sign out all other sessions in the sessions section, then sign out on this device.

Display preferences

The profile section has two toggles:

• Compact mode — tighter spacing in lists and tables
• Show timestamps in local time — uses your timezone setting

Both preferences are stored per-account, not in the browser. They follow you across devices.

Notification email

The profile email is your login email. It's also where ATHELOS sends notifications — if SMTP is configured.

To send notifications to a different address, configure it in Settings → Notifications.

Deleting your account

ATHELOS doesn't support account deletion through the UI. Single-user systems rarely need it.

To delete the account:

1. Sign out
2. Remove the user row from the database:

   docker exec soc_postgres psql -U soc -d soc_solo \\
     -c "DELETE FROM users WHERE email = 'you@example.com';"

This cascades — sessions, recovery codes, and WebAuthn credentials are removed.

All your data stays. Clients, engagements, findings, reports, invoices are preserved. Only the account is removed. To start fresh, re-seed with the setup script.

Recovery

If you're locked out:

Forgot password, no TOTP

Reset from the CLI:

cd /home/kali/soc-solo-os
SEED_EMAIL=you@example.com SEED_PASSWORD='new-password' pnpm seed:user

The seed script detects an existing user and updates the password.

Forgot password, TOTP enabled

Same as above, plus you'll need a recovery code or your authenticator to complete login.

Lost TOTP device and recovery codes

You'll need direct database access. See Troubleshooting: common issues.

Where to go next

• Security — threat model and hardening
• Two-factor — TOTP setup
• WebAuthn — hardware key setup