StepSecurity contrasts Harden Runner with GitHub's egress firewall

GitHub’s native egress firewall currently covers GitHub-hosted Linux runners, according to the article’s author. The piece contrasts this with Harden-Runner, StepSecurity’s runtime security agent for CI/CD runners, which it says provides broader protection by extending controls beyond GitHub-hosted Linux to Linux, Windows, and macOS and across both GitHub-hosted and self-hosted runners.

Harden-Runner can be deployed via Actions Runner Controller on Kubernetes, virtual machines, or bare-metal, offering platform teams flexibility for future infrastructure changes.

The article outlines five distinctions. First, it notes Harden-Runner’s cross-platform coverage and deployment options as a strong advantage for unified security across environments. Second, it describes network baselines and anomaly detection with a central dashboard that correlates network, process, and file events to specific workflow steps, with API and MCP server access.

Third, StepSecurity argues for threat intelligence and automatic response, including a Global Block List that can block known malicious endpoints even in audit mode, and lockdown mode to terminate offending processes. Fourth, Harden-Runner’s file-write monitoring is highlighted as a way to detect build tampering, describing how it tracks in-flight changes to checked-out sources during builds.

Fifth, the article discusses centralized visibility for registry adoption, enabling searches for destinations like npmjs[.]org and PyPI and supporting deny policies to enforce approved registries, with ongoing work on a Policy Store.

StepSecurity cites real-world detections, including the tj-actions/changed-files compromise, Nx, and Sha1-Hulud, and emphasizes that these capabilities automate protection and assist teams in answering “Are we impacted?” when incidents surface.