StepSecurity

Seattle, Washington, USA · ≈27 employees · stepsecurity.io

StepSecurity is a cybersecurity startup founded in 2021, based in Seattle, Washington. The company focuses on securing software supply chains by protecting CI/CD (Continuous Integration/Continuous Deployment) pipelines, particularly through GitHub Actions. It was established by former Microsoft security engineers Varun Sharma and Ashish Kurmi in response to significant security breaches that exposed vulnerabilities in CI/CD environments. The company offers an end-to-end security platform that includes several key features. Its core product, Harden-Runner, provides network egress filtering and runtime security for GitHub Actions runners. Other features include automatic replacement of risky third-party actions, real-time threat detection, policy enforcement for compliant workflows, and security for AI coding agents. StepSecurity serves both open-source communities and enterprise organizations, with a free version for open-source developers and a paid enterprise tier for corporate clients. The company is also planning to expand its support to additional CI/CD environments in the future.