- Home
- Software Supply Chain Security Software
- StepSecurity
StepSecurity
What it is
StepSecurity is a software supply chain security platform covering developer machines, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then correlates events with workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines. Secure Registry offers package cooldowns, blocks compromised versions, guards against typosquats, and supports blocklists. Code Repo Security screens pull requests and can open policy-driven remediation pull requests across repositories. Notifications can go by email, Slack, or Microsoft Teams. Dev Machine Guard can be deployed without an agent through Intune, SCCM, or Jamf on macOS, Windows, and Linux. Listed integrations include GitLab CI, Azure DevOps, JFrog Artifactory, Sonatype Nexus, and Google Artifact Registry. The free Community plan covers unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day free trial. Dev Machine Guard costs $8 a month per device, and Enterprise costs $16 a month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance.
For and against
For
- Monitors pipeline activity with eBPF
- Inventories developer-machine tools and packages
- Screens pull requests and can open remediation requests
- Supports email, Slack, and Microsoft Teams alerts
- Trust Center lists SOC 2 Type 2 and ISO 27001:2022
Against
- Free Community plan is limited to public repositories
- Private repositories are included in the 14-day trial
- Dev Machine Guard costs $8 a month per device
- Enterprise costs $16 a month per contributing developer
The verdict
StepSecurity brings pipeline monitoring, repository controls, package protections, and developer-machine inventory into one platform. Plan scope and per-device or per-developer pricing are key considerations.
Who it suits
StepSecurity describes its platform for contributing developers and offers Dev Machine Guard for employees who use development tools but do not contribute code. The free Community plan may suit teams working with public repositories and GitHub-hosted runners on GitHub Cloud.
Plans and prices
Community
Unlimited public repositories · GitHub-hosted runners on GitHub Cloud · Community support
Read 3 Oct 2026 · stepsecurity.io
Dev Machine Guard
Device and registry protection · Includes Secure Registry · For employees who do not contribute code
Read 3 Oct 2026 · stepsecurity.io
Enterprise
Full platform · Includes Dev Machine Guard and Secure Registry · Priority support with support SLAs
Read 3 Oct 2026 · stepsecurity.io
On the record
- CI/CD monitoring
- Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, correlating events to workflow steps.docs.stepsecurity.io · read 3 Oct 2026
- Company
- The company page identifies Varun Sharma as CEO and co-founder and Ashish Kurmi as CTO and co-founder.stepsecurity.io · read 3 Oct 2026
- Developer machine inventory
- Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines.stepsecurity.io · read 3 Oct 2026
- Integrations
- The pricing page lists GitLab CI, Azure DevOps, JFrog Artifactory, Sonatype Nexus, and Google Artifact Registry compatibility.stepsecurity.io · read 3 Oct 2026
- Intended users
- StepSecurity describes its full platform as serving contributing developers and offers Dev Machine Guard for employees who use development tools but do not contribute code.stepsecurity.io · read 3 Oct 2026
- Notable limits
- The free Community plan is for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day free trial.stepsecurity.io · read 3 Oct 2026
- Notifications
- Security event notifications can be sent by email, Slack, or Microsoft Teams.docs.stepsecurity.io · read 3 Oct 2026
- Operating systems
- The pricing page lists agentless Dev Machine Guard deployment through Intune, SCCM, or Jamf on macOS, Windows, and Linux.stepsecurity.io · read 3 Oct 2026
- Package protection
- Secure Registry provides cooldown periods, compromised-version blocking, typosquat protection, and package blocklists.stepsecurity.io · read 3 Oct 2026
- Product
- StepSecurity detects, prevents, and responds to software supply chain attacks across developer environments, code repositories, and CI/CD pipelines.docs.stepsecurity.io · read 3 Oct 2026
- Repository controls
- Code Repo Security screens pull requests and can open policy-driven remediation pull requests across repositories.stepsecurity.io · read 3 Oct 2026
- Security compliance
- The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance and provides audit and penetration testing reports.trust.stepsecurity.io · read 3 Oct 2026
- Support
- The Community plan includes community support, while Enterprise and Dev Machine Guard list priority support.stepsecurity.io · read 3 Oct 2026
