StepSecurity
CI/CD supply-chain security with runtime anomaly detection for GitHub Actions.
About
StepSecurity hardens CI/CD pipelines against supply-chain attacks, with its flagship Harden-Runner acting as endpoint detection and response for GitHub Actions runners. Harden-Runner instruments each runner at job start, monitors outbound network connections, file system changes, and process activity, and builds a behavioral baseline per job so that anomalous activity such as unexpected domains or unauthorized file modifications is flagged in real time.
The tool has a public track record of catching real compromises, including the tj-actions changed-files attack and anomalous behavior in widely used build packages. Its open-source Harden-Runner action has earned more than a thousand GitHub stars, and the company maintains a global block list of malicious domains tied to active supply-chain attacks.
What it can do
- Runtime monitoring of network egress, files, and processes
- Automated behavioral baselines built per CI job
- Anomaly detection tuned for supply-chain attacks
- Domain allowlists and egress blocking enforcement
Setup
Add the step-security/harden-runner action to a GitHub workflow with an egress policy of audit or block, then review the runtime insights dashboard.
Prerequisites
GitHub Actions workflows; a StepSecurity plan for private repositories and self-hosted runners.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 127; Trending score 74/100 from researcher assessment.
★ 1,055 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.