step-security

harden-runner

TypeScript2022–2026

step-security / harden-runner

harden-runner

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

Explore on GitHub Read Hacker News discussions

4Distinct people

12Mentions

0Explicit recommenders

1.3KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year12 dated mentions

Observed mentions: 2022-02-27 05:16:43 UTC to 2026-05-12 16:47:00 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	5	1	4
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	3	1	2
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	0	0	0
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	3	0	3
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	1	0	1

What Hacker News says

12 sources

varunsharma07·May 12, 2026

We have built an AI Package Analyst https://app.stepsecurity.io/oss-security-feed and also monitor them using https://github.com/step-security/harden-runner for runtime behavior.

In Postmortem: TanStack NPM supply-chain compromise

ignoramous·Dec 8, 2025

> Some teams vendor actions into their own repos. zizmor is excellent at scanning workflows and finding security issues. But these are workarounds for a system that lacks the basics. Harsh given GitHub makes it very easy to setup attestations for Artifact (like build & sbom) provenances. That said, Zizmor (static analyser for GitHub Actions) with Step Security's Harden Runner (a runtime analyser) [0] pair nicely, even if the latter is a bit of an involved setup. [0] https://github.com/step-security/harden-runner > The fix is a lockfile. Hopefully, SLSA drafts in Hermetic build process as a requirement: https://slsa.dev/spec/v1.2/future-directions

In GitHub Actions has a package manager, and it might be the worst

varunsharma07·Mar 15, 2025

Great points! Harden-Runner (https://github.com/step-security/harden-runner) is similar to Firejail and OpenSnitch but purpose-built for CI/CD context. Harden-Runner detected this compromise due to an anomalous outbound network request to gist.githubusercontent.com. Interestingly, Firejail itself uses Harden-Runner in its GitHub Actions workflows! https://github.com/search?q=repo%3Anetblue30%2Ffirejail%20ha...

In Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

kurmiashish·Mar 14, 2025

Disclaimer: I am a co-founder of StepSecurity. StepSecurity Harden-Runner detected this security incident by continuously monitoring outbound network calls from GitHub Actions workflows and generating a baseline of expected behaviors. When the compromised tj-actions/changed-files Action was executed, Harden-Runner flagged it due to an unexpected endpoint appearing in the network traffic—an anomaly that deviated from the established baseline. You can checkout the project here: https://github.com/step-security/harden-runner

In Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

varunsharma07·Jan 25, 2023Submission

Show HN: Protect Your CI/CD from SolarWinds-Type Attacks with This Agent

Hello HN, my name is Varun, and I am the co-founder of StepSecurity. Here is the backstory about Harden-Runner. We thoroughly researched past software supply chain security incidents. The devastating breaches of SolarWinds, Codecov, and others, have one thing in common – they attacked the CI/ CD pipeline or the build server. These incidents made it clear that a purpose-built security agent was needed for CI/ CD. While there are numerous agents available for desktops and servers, such as from CrowdStrike and Lacework, none have been tailored specifically to address the unique risks present in CI/CD pipelines. With the understanding that a specialized solution was needed to secure CI/CD environments, we developed Harden-Runner, an open-source solution tailored specifically for GitHub Actions hosted runners. It can be seamlessly integrated i

Read the rest

nto your workflow by simply adding a step. The agent installation process is also lightning-fast, taking no more than 5 seconds to complete. Harden-Runner's security agent is designed to closely monitor all aspects of the workflow run, including DNS, network, file, and process events. This allows for real-time identification of any potential security breaches. To prevent incidents like the Codecov breach, where exfiltration of credentials occurred, Harden-Runner allows you to set policies that restrict outbound traffic at both the DNS and network layers. Additionally, we are actively working on implementing further restrictions at the application layer, such as using HTTP verbs and paths, to provide an even more comprehensive security solution. An excellent example of how Harden-Runner effectively blocks outbound traffic can be found in the following link: https://app.stepsecurity.io/github/microsoft/msquic/actions/.... As you can see, all traffic to unauthorized endpoints is highlighted in red, indicating that it has been blocked; this is because these endpoints are not included in the allowed list defined in the GitHub Actions workflow file, which can be viewed here: https://github.com/microsoft/msquic/blob/aaecb0fac5a3902dd24.... One of the key features of Harden-Runner's monitoring capabilities is its ability to detect any tampering or alteration of files during the build process, similar to the SolarWinds incident. To further enhance security and protect against potential malicious tools or attempts to disable the agent, Harden-Runner includes a disable-sudo mode. This mode effectively disables the use of 'sudo' on the hosted runner, providing an additional layer of protection Harden-Runner has already been adopted by over 600 open-source repositories: https://github.com/step-security/harden-runner/network/depen.... To fully understand the capabilities of Harden-Runner and how it can protect against past supply chain attacks, please try out our attack simulator GitHub repository at https://github.com/step-security/attack-simulator. I would love to hear your feedback.

15 points · Open discussion

varunsharma07·Jan 1, 2023

If using GitHub Actions for CI/ CD, Harden Runner (https://github.com/step-security/harden-runner) can be used to audit and block DNS exfiltration. Outbound calls from CI are predictable (to source repo, artifact registry, etc.) and don't change often.

In Compromised PyTorch-nightly dependency chain between December 25th – December 30

varunsharma07·Jan 1, 2023

If CI/ CD pipeline uses GitHub Actions, you can monitor and even block outbound network calls at the DNS and network level using Harden Runner (https://github.com/step-security/harden-runner). It can also detect overwrite of files in the working directory. Harden Runner would have caught this dependency confusion and similar attacks due to a call to the attacker endpoint.

In Compromised PyTorch-nightly dependency chain between December 25th – December 30

varunsharma07·May 4, 2022

I agree. There are projects such as https://github.com/ossf/package-analysis and https://github.com/step-security/harden-runner that do behavior analysis. Disclosure: I’m maintainer of the second one.

In Sigstore - A new standard for signing, verifying and protecting software

newman314·Apr 28, 2022

So if you are concerned about this, I'd suggest looking at the following: * OpenSSF Scorecard Action - https://github.com/ossf/scorecard#scorecards-github-action * Step Security Harden Action - https://github.com/step-security/harden-runner I realize that this means trusting these providers but they seem at least tacitly blessed by GitHub. https://docs.github.com/en/actions/security-guides/security-...

In Best practices to keep your projects secure on GitHub

varunsharma07·Mar 19, 2022

Here is one such tool for GitHub Actions: https://github.com/step-security/harden-runner. It would have detected and blocked the call to pastebin.com in this scenario. I am the maintainer of this tool.

In Show HN: npm install actual-malware

varunsharma07·Feb 28, 2022Submission

Show HN: harden-runner: GitHub Action to prevent software supply chain attacks

11 points · Open discussion

varunsharma07·Feb 27, 2022

Thanks for the mention for harden-runner GitHub Action! sharing the link: https://github.com/step-security/harden-runner

In How to optimize the security, size and build speed of Docker images