# HardenRunner

GitHub Actions runtime security.

Source: [Console review](<https://console.dev/tools/hardenrunner>)

Website: [https://github.com/step-security/harden-runner](<https://github.com/step-security/harden-runner>)

Profile updated: 2026-10-16

Category: [Vulnerability management](<https://console.dev/tools/categories/security-vulnerability-management>)

## Supported tech stack

Research checked: 2026-10-11

### Runs on

- Linux (Operating system)
- Windows (Operating system)
- macOS (Operating system)

### Integrates with

- GitHub Actions (Integration)

Source: [Research source](<https://github.com/step-security/harden-runner>)

Documented compatibility; coverage may be incomplete. Written in describes implementation, not user-project language support.

GitHub Actions security agent supports Linux, Windows and macOS runners.

## Console’s review — 2023-10-05

Reviewed: 2023-10-05

Author: [David Mytton](<https://console.dev/about#david-mytton>)

Citation: [This review](<https://console.dev/tools/hardenrunner#review_6ffefb8a4fc042eea018be12fd1d43108abec6e661f4f0529a91542c5d00fc1d>)

### What we like

Protects runner workflows from exfiltration-style attacks by providing network observability for the runtime environment. Monitors files, process & network activity. Can block egress traffic (with allowlists), detect source code tampering, and compromised dependencies. Runs on GitHub hosted, self hosted, and VM runners.

### Tradeoffs

Analysis and security recommendations are provided via a link to a web UI in the workflow output rather than natively as part of the output logs.

This review reflects Console’s assessment at publication on 2023-10-05. Features and limitations may have changed since the review date.

## Is HardenRunner a fit?

Based on [Console’s review published on 2023-10-05](<https://console.dev/tools/hardenrunner#review_6ffefb8a4fc042eea018be12fd1d43108abec6e661f4f0529a91542c5d00fc1d>).

Summary updated: 2026-10-16

### Who it’s for

Developers using GitHub Actions should consider HardenRunner for runtime security

### Why consider it

HardenRunner protects runner workflows from exfiltration-style attacks

### Keep in mind

Security recommendations are not provided natively in the output logs

[Selection criteria](<https://console.dev/selection-criteria>) · [About Console](<https://console.dev/about>) · [Browse tools](<https://console.dev/tools>)