StepSecurity protects the software supply chain, from the developer’s laptop through the code repository and package registry to the CI/CD runner. Engineering and security teams use it to detect, prevent and respond to supply chain attacks, whether the threat is a compromised open source package, a risky GitHub Action or an unmanaged AI coding agent.
It is aimed at organisations that build software on GitHub and open source ecosystems, where a single compromised dependency or build step can expose secrets and ship malicious code to customers.
At A Glance
| Vendor | StepSecurity |
|---|---|
| Category | Software supply chain and CI/CD security |
| Deployment | Hosted service with a runner agent, registry configuration and an MDM-pushed script |
| Agentic AI | Inventory and policy for AI coding agents, plugins and MCP servers |
| Customers | Mercari, Miro, Chainguard, Dexcom, Kong |
| Founders | Varun Sharma (CEO), Ashish Kurmi (CTO) |
| Market classification | Application Security |
What StepSecurity Does
Supply chain attacks rarely hit production directly. They arrive through a poisoned npm or PyPI release, a third-party Action that leaks secrets from a build, or an extension a developer installed without review. StepSecurity places a control at each of those points, from the laptop to the repository, the registry and the build runner, and feeds all of them from one threat intelligence source, so an indicator found in one place can be blocked everywhere. Rollout is kept light: one line of YAML for CI, one configuration line for the registry and one MDM push for laptops, with nothing for the customer to host.
Products
Harden-Runner And CI/CD Security
Build runners hold secrets and have open network access, which makes them a favoured target. Harden-Runner is an agent for those runners, working much like an EDR for GitHub Actions. It uses eBPF to watch outbound network calls, file writes and process execution, ties each event to the workflow step that caused it, and can restrict egress so exfiltration attempts are blocked at runtime. Detections stream to a SIEM. Linux GitHub-hosted runners get full support, while Windows and macOS hosted runners run in audit mode. The agent is open source under Apache 2.0 and is used by more than 13,000 reported open source projects and enterprises.
Dev Machine Guard
Security teams often have no idea which AI agents, MCP servers or IDE extensions developers have installed. Dev Machine Guard builds a live inventory of them, along with packages on disk, checks everything against StepSecurity threat intelligence and lets teams set policy on what may run. Device Policy delivers approved extension sets through MDM. Coverage includes CLI assistants, IDE agents and local AI runtimes such as Claude Code, Codex, Cursor and Ollama; for each MCP server it shows which AI tools registered it and which devices run it, and Claude Code and Codex plugins are inventoried on machines and in GitHub repositories, since plugins can add skills, hooks and MCP servers. It runs on macOS, Windows and Linux and is licensed under Apache 2.0.
Code Repo Security
Code Repo Security screens pull requests across repositories, adds GitHub Checks that block compromised npm packages, and opens remediation pull requests when a fix is available.
Secure Registry
Secure Registry sits in front of public package sources and blocks compromised packages for builds and laptops. Local installs routed through it can be held back by a cooldown period, so brand new releases are not pulled in the moment they appear.
Threat Intel And Maintained Actions
- Advisories listing affected versions, indicators of compromise and remediation steps
- Maintained replacements for risky third-party GitHub Actions
- A GitHub Actions audit service for existing workflows
How It Works
The platform is a hosted service, so nothing has to be run by the customer apart from small components placed where code is written and built.
| Component | What it does |
|---|---|
| Runner agent | Harden-Runner is added to a workflow with one line of YAML and reports from inside each job. |
| Registry | Secure Registry is switched on with a single configuration line that points package managers at it. |
| Developer machine script | Dev Machine Guard is a lightweight script pushed through Intune, SCCM or Jamf. It is neither an MDM nor an EDR, so it sits alongside existing endpoint tools. |
| Repository checks | Code Repo Security runs as checks on pull requests in GitHub. |
Integrations
| Area | Integrations |
|---|---|
| CI/CD | GitHub Actions, GitLab CI, Azure DevOps |
| Source control | GitHub repositories and GitHub Checks |
| Device management | Intune, SCCM, Jamf |
Company Background
| Founders | Varun Sharma (CEO and Co-Founder) and Ashish Kurmi (CTO and Co-Founder) |
|---|---|
| Funding | Venture backed |
| Workforce | Remote teams in the United States and India |
Note: This overview is compiled from StepSecurity’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.