ActionRank
Check your actions

Harden-Runner

Actively maintained

step-security/harden-runner · Apache-2.0

Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners. It monitors network egress, file integrity, and process activity on those runners, detecting threats in real-time.

★ 1.2k starsLast commit 25 days agoLatest v2.20.0
B
78
/ 100
Security 79Maintenance 96Popularity 55Reliability 70

Security signals

OpenSSF Scorecard7.9 / 10
SECURITY.md presentYes
Immutable releasesEnabled
Known vulnerabilities5 advisory(ies)
  • CVE-2026-32947moderate

    Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)

    Published Mar 17, 2026
  • CVE-2026-25598moderate

    Harden-Runner: Bypassing Logging of Outbound Connections Using sendto, sendmsg, and sendmmsg in Harden-Runner (Community Tier)

    Published Feb 9, 2026
  • CVE-2026-32946moderate

    Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)

    Published Mar 17, 2026
  • CVE-2024-52587low

    Harden-Runner has a command injection weaknesses in `setup.ts` and `arc-runner.ts`

    Published Nov 18, 2024
  • CVE-2025-32955moderate

    Harden-Runner allows evasion of 'disable-sudo' policy

    Published Apr 22, 2025

How to use it safely

Recommended: pin to commit SHA
uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0

Mutable tags like v2.20.0 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0

Score breakdown

Security (35%)79
Popularity (20%)55
Maintenance (30%)96
Reliability (15%)70