Hacker GitHub

← All repos

step-security/harden-runner

View on GitHub ↗ ★ 1,295 TypeScript

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

12 mentions on Hacker News by 4 people: 2 stories, 10 comments · first 2022-02-27 · latest 2026-05-12

Mentions per year 12 mentions · busiest year 2022 (5)
20082026
AllStoriesComments NewestTopOldest
  1. …an AI Package Analyst https://app.stepsecurity.io/oss-security-feed and also monitor them using https://github.com/step-security/harden-runner for runtime behavior.
    comment by varunsharma07 · 2026-05-12 · in Postmortem: TanStack NPM supply-chain compromise
  2. …Runner (a runtime analyser) [0] pair nicely, even if the latter is a bit of an involved setup. [0] https://github.com/step-security/harden-runner > The fix is a lockfile. Hopefully, SLSA drafts in Hermetic build process as a requirement:…
    comment by ignoramous · 2025-12-08 · in GitHub Actions has a package manager, and it might be the worst
  3. Great points! Harden-Runner ( https://github.com/step-security/harden-runner ) is similar to Firejail and OpenSnitch but purpose-built for CI/CD context. Harden-Runner detected this compromise due to an anomalous outbound network request…
    comment by varunsharma07 · 2025-03-15 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
  4. …traffic—an anomaly that deviated from the established baseline. You can checkout the project here: https://github.com/step-security/harden-runner
    comment by kurmiashish · 2025-03-14 · in Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
  5. If using GitHub Actions for CI/ CD, Harden Runner ( https://github.com/step-security/harden-runner ) can be used to audit and block DNS exfiltration. Outbound calls from CI are predictable (to source repo, artifact registry, etc.) and…
    comment by varunsharma07 · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30
  6. …monitor and even block outbound network calls at the DNS and network level using Harden Runner ( https://github.com/step-security/harden-runner ). It can also detect overwrite of files in the working directory. Harden Runner would have…
    comment by varunsharma07 · 2023-01-01 · in Compromised PyTorch-nightly dependency chain between December 25th – December 30
  7. I agree. There are projects such as https://github.com/ossf/package-analysis and https://github.com/step-security/harden-runner that do behavior analysis. Disclosure: I’m maintainer of the second one.
    comment by varunsharma07 · 2022-05-04 · in Sigstore - A new standard for signing, verifying and protecting software
  8. …Action - https://github.com/ossf/scorecard#scorecards-github-action * Step Security Harden Action - https://github.com/step-security/harden-runner I realize that this means trusting these providers but they seem at least tacitly blessed by…
    comment by newman314 · 2022-04-28 · in Best practices to keep your projects secure on GitHub
  9. Here is one such tool for GitHub Actions: https://github.com/step-security/harden-runner . It would have detected and blocked the call to pastebin.com in this scenario. I am the maintainer of this tool.
    comment by varunsharma07 · 2022-03-19 · in Show HN: npm install actual-malware
  10. Thanks for the mention for harden-runner GitHub Action! sharing the link: https://github.com/step-security/harden-runner
    comment by varunsharma07 · 2022-02-27 · in How to optimize the security, size and build speed of Docker images