Cloud security you can run yourself.
NightWatch brings cloud scanning, findings triage, framework compliance, uptime monitoring, and audit-ready operations into one self-hosted codebase you can read, run, and extend.
What it does
One codebase, the whole operator surface.
Security posture, uptime, compliance, and access control ship together — the same product areas you get in the app, without a per-seat bill.
From raw scans to reviewed findings.
Connect AWS and GCP accounts, run manual or scheduled scans, and triage everything in one faceted explorer — no exporting scanner output to another tool.
- Faceted findings explorer — severity, service, rule, and resource filters in one place.
- Resource inventory — every scanned asset accounted for, with service coverage views.
- Excel / PDF export — reports generated asynchronously by the report-generate queue.
Uptime probes, SLOs, and infra health.
NightWatch is not scan-only: endpoint monitors probe your services, alert policies track down-streaks, and SLOs recalculate after every run.
- Endpoint monitors — HTTP probes with alert policies that follow contiguous down-streaks.
- SLO tracking — targets recalculated by the slo-recalculate queue after each monitor run.
- Infrastructure health — AWS collectors feed a live infrastructure view.
43 frameworks, down to the failing check.
Findings reconcile into framework scorecards on the dashboard, and every framework opens into per-control detail linked back to the exact rule.
- 43 frameworks mapped — CIS, SOC 2, HIPAA, PCI DSS 4.0, ISO 27001 and more.
- Per-control detail — from scorecard to the specific check and resource that failed.
- Dashboard rollups — compliance posture surfaces on the overview, not a separate silo.
Tenant-safe teams, RBAC, and a real audit trail.
Organizations stay isolated with tenant-scoped services and PostgreSQL row-level security, while every sensitive action lands in an auditable trail.
- Teams & members — org-scoped roles with a visible RBAC permission matrix.
- Audit trail — sensitive actions recorded with actor, tenant, and context.
- Access reports — review who can reach what, exportable for compliance evidence.
Scan pipeline
Four queues. One finalize gate. No hidden background magic.
Every scan flows through the same ordered BullMQ pipeline. A scan only completes when the finalize gate confirms every evaluation job has terminally resolved — then findings reconcile and daily aggregates refresh.
Rules
570+ real checks, stored as data you can query.
The catalog is synced from Prowler and stored as versioned rows in Postgres — stable check IDs, per-service coverage, and framework mappings in their own table. Findings inherit structure instead of bleeding raw scanner output.
- Stable check IDs — the same identifier from catalog to finding to framework detail.
- Framework mappings — a single check can back dozens of framework controls via mapping rows.
- No opaque engine — rule metadata lives in your database, not behind a vendor API.
S3 bucket is not publicly accessible to Everyone or Authenticated Users
Root account has MFA enabled
RDS DB instance storage is encrypted at rest
Setup
Clone it. Bootstrap it. Run the stack locally.
The strongest proof NightWatch offers is the setup path the repo already supports. Install dependencies, start infra, migrate, seed, and run — no hosted SaaS required.
- Bun + Turborepo — one install, one dev command for the whole monorepo.
- Docker-backed infra — PostgreSQL, Redis, and Mailpit via Compose.
- Two bootstrap paths —
db:seedfor a demo in minutes,bun run setupfor production.
Self-host NightWatch
Clone it. Run it. Own the control plane.
NightWatch is open source and self-hosted. Start with the repository, then follow the setup guide to bring the full stack up locally.