Harden-Runner

Runner agent from StepSecurity that records and can block outbound network calls, file tampering and processes per job.

github.com/step-security/harden-runner ↗

Stars: ★ 1,279
License: Apache-2.0
Language: TypeScript
Latest release: v2.22.1 · 8 Oct 2026
Last push: 8 Oct 2026
OpenSSF Scorecard: 7.8 / 10

ghtier rating4/5 · Recommended

The established runtime monitor for hosted runners and the tool that caught tj-actions, but the insights live in StepSecurity's service.

How it works

You add Harden-Runner as the first step of a job. It installs an agent on the runner that watches DNS lookups, outbound connections, processes and writes to the checked-out source for the rest of the job.

With egress-policy: audit it only records. The recorded endpoints become a baseline you turn into an allowed-endpoints list, and with egress-policy: block anything else is refused. Each run gets an insights page in StepSecurity's app that shows which step called what.

What it catches

Exfiltration to unexpected domains or IPs
A compromised action or dependency reaching out at runtime
Source files modified during the build
Unexpected processes started by a step

Run it

# Runs only inside GitHub Actions, as the first step of a job:
- uses: step-security/harden-runner@<sha> # pin to a release SHA
  with:
    egress-policy: audit

What leaves your machine

Network, process and file events from the job are sent to StepSecurity's API to build the insights page.

Limits

Advanced features and private-repository use beyond the free tier need a StepSecurity plan.
Block mode needs a maintained allow-list per job, which takes effort across many repositories.
It protects the job it runs in, not other jobs on the same self-hosted runner.

Related tools

zizmor★ 6.7k

Related incidents

ApplicationMarch 2025

tj-actions/changed-files supply-chain compromise (CVE-2025-30066)

The attacker used a previously obtained GitHub token with write permissions to push a commit disguised as renovate[bot], slipped into a legitimate auto-merged PR, then retroactively repointed multiple version tags at the malicious commit, affecting over 23,000 repositories. The payload dumped runner memory to logs, exposing access keys, PATs, npm tokens, and private RSA keys. Upstream, reviewdog/action-setup (CVE-2025-30154) was backdoored first, and researchers traced the original target to Coinbase's agentkit repo. The permission abused, contents:write on an Action repo, implies tag-write, which implies control of every consumer pinning by tag.

Click to open →

OrganizationSeptember 2025, returned 2026

GhostAction

327 compromised GitHub user accounts were used to inject workflows disguised as "Add GitHub Actions Security workflow" across 817 repositories, stealing 3,325 secrets. The actors enumerated secret names from legitimate workflow files first, then hardcoded those names into their own workflow, harvesting PyPI, npm, DockerHub, GitHub, Cloudflare, and AWS credentials. It came back in 2026. GitGuardian found the malicious workflow in 772 public repositories belonging to 373 users and organizations between 31 August and 30 September 2026, aimed at 2,577 secrets; GitHub held most of the runs for approval, and by 5 October only 16% of the repositories had removed the workflow. From 7 October Socket saw more than 500 accounts committing it to tens of thousands of repositories.