9,000 Open-Source Projects Now Secured by Harden-Runner

StepSecurity’s Harden-Runner now protects over 9,000 open-source repositories, delivering real-time CI/CD runtime security and defending pipelines against modern supply chain attacks. The platform monitors more than 12 million jobs per week across workflows from individual developers to Fortune 500 companies, marking a shift from reactive incident response to proactive, continuous protection.

In a nod to industry guidance, according to OWASP, CI/CD pipelines are now a top 10 risk, with software supply chain failures highlighted as a primary concern in the 2025 Top 10, underscoring the need for runtime visibility inside pipelines. The article notes growing adoption, with CrowdStrike open-source projects and Kong repositories increasingly integrating Harden-Runner into their GitHub Actions workflows.

Published on 17 November 2025, the update also emphasises new capabilities, including baking Harden-Runner into custom GitHub runner images and policy management features to simplify enforcement across environments.