StepSecurity CI/CD Security

StepSecurity is a CI/CD security platform that provides visibility, detection, response, and remediation capabilities for GitHub Actions pipelines. The platform monitors network, file, and process activity on CI/CD runners to detect and block suspicious behavior in real-time.

The platform's Harden-Runner component provides runtime protection by monitoring all activity during CI/CD job execution. It correlates security events with specific job steps, showing which action triggered each network call, file write, or process execution. The system automatically creates behavioral baselines for every job in the pipeline and alerts when jobs make network calls outside their normal patterns.

StepSecurity offers anomaly detection capabilities that identify deviations from established baselines, which has been proven effective in detecting real-world supply chain attacks. The platform can block unauthorized network egress traffic by enforcing job-level baselines, allowing only necessary connections.

The platform includes an Internal Marketplace feature that enables organizations to vet, approve, and manage GitHub Actions internally. This provides centralized control over which actions developers can use while maintaining compliance requirements.

Integration with GitHub Checks provides real-time security feedback directly in the development workflow. The platform offers automated remediation capabilities to address identified security issues.

StepSecurity has demonstrated effectiveness in detecting actual CI/CD compromises, including the tj-actions/changed-files breach, PyTorch supply chain compromise, XZ Utils backdoor, and Stripe repository vulnerability.