Security
Your firewall credentials never leave your network
You are being asked to give a tool administrative access to the devices that protect everything else. That deserves a straight answer about where those credentials go, which is nowhere.
Architecture
There is no cloud in the path
Night Agent is software you install and run yourself — on a workstation or a jump host inside your own network. It connects outward to your firewalls over the PAN-OS XML API. That is the entire data path.
What talks to what
- Your machine → your firewalls, over HTTPS on your network
- Nothing is installed on the firewall
- No agent, no collector, no polling service
- No configuration, log or credential is sent to us
The one exception, and what it carries
Licensing. The application periodically validates your license key against our license server. That request carries the license key and a machine identifier — nothing about your configuration or your upgrades.
One thing about your devices does travel, and only on licenses that cover a limited number of them: a SHA-256 hash of each serial number, so they can be counted. The serial itself is never sent, the hash is salted with your license id so the same firewall under a different license produces an unrelated value, and a license with no device limit sends nothing at all.
It also checks the public Palo Alto security advisory feed to tell you about known vulnerabilities in the version you are leaving. That lookup sends a PAN-OS version number and nothing else.
Credential handling
Six rules we hold ourselves to
These are enforced in the product, not policy statements. Each one is a constraint the code is built around.
Your credentials never leave your network
Night Agent runs on your machine and connects directly to your firewalls. There is no cloud service in the path, and no configuration, log or credential is transmitted to us. Licensing is the one exception, and it carries a license key, a machine identifier, and — only where a license limits how many devices it covers — a salted hash of each serial number so they can be counted.
Passwords are never stored in plaintext
Saving credentials is opt-in. When you do, they're encrypted at rest using Windows DPAPI, scoped to your user account. They are never written to logs, never returned by any internal API, and never rendered into a page.
Passwords are never put on a command line
Credentials reach the upgrade and check processes through an environment variable only — not as arguments, which would be visible to any other process on the machine.
Nothing is installed on the firewall
All work is done through the PAN-OS XML API over HTTPS. There is no agent, no collector, and nothing left behind on the device when a run finishes.
Stored credentials can always be removed
Anything saved can be cleared from the interface — per device, or per scheduled job. In-memory credentials are wiped when a run completes and expire on a timer regardless.
Everything is auditable
Each run keeps its own directory with the full log, the config backup, both snapshots and the results. Nothing about what happened is hidden from you.
In practice
Where a password can and cannot appear
Where it goes
- Held in memory for the duration of a run, then cleared
- Encrypted at rest, only if you opt in to saving it
- Passed to upgrade steps through an environment variable
- Sent to the firewall itself, over HTTPS, to get a session token
Where it never goes
- Log files, including the per-run output log
- Reports, snapshots or the run history
- Any URL, query string or command line
- The device inventory file
- Any page rendered in the interface
- Anywhere off your machine
Why the command line matters
On a shared or multi-user machine, process arguments are readable by other users. A tool that passes a password as a command-line argument leaks it to anyone who can run a process listing. Night Agent passes credentials to its subprocesses through the environment instead, and keeps them out of URLs for the same reason — they end up in logs.
Operational safety
Being careful with credentials isn't enough
The other half of security here is not breaking the firewall.
It backs up first
The running configuration is exported before any change is made, and kept with the run.
It refuses unsafe upgrades
An unsupported upgrade path, insufficient disk space or an unhealthy HA state stops the run before the download starts.
It asks rather than guesses
When a decision genuinely needs a human — a reboot it isn't certain about — it pauses and waits for you.
Reviewing us before you buy
If your security team needs to assess Night Agent before it touches production, we'd rather have that conversation early. Get in touch and we'll walk through the architecture, the credential handling, and what the application does and doesn't send anywhere.