Step Security Adds Deny-List Egress Policies to Harden-Runner
Summary
Step Security added deny-list egress policies to Harden-Runner, letting teams block specified domains and IPs while leaving other destinations reachable. The vendor says policies can be centrally applied and cautions they do not replace allow lists.
Key points
- Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input; self-hosted VM Harden Runner v1.9.0 supports the input, and ARC Harden Runner v2.19.0 supports deny lists through the Policy Store.
- Deny entries can specify domains, wildcard domains or IP addresses. A listed destination is blocked on every port; a port included in an entry is ignored.
- Step Security says Policy Store policies can be attached at organization or cluster scope, avoiding edits to individual workflow files.
- The vendor recommends denying direct public package-registry access to enforce routing through Secure Registry: registry[.]npmjs[.]org, pypi[.]org, files[.]pythonhosted[.]org, repo1[.]maven[.]org, api[.]nuget[.]org, proxy[.]golang[.]org and sum[.]golang[.]org.
- Step Security says deny lists can prevent CI jobs from reaching destinations such as public registries, including to reduce the risk of a job publishing packages with a stolen token.
- Deny lists are open by default and only block named destinations. The article says they cannot stop exfiltration to an allowed service such as github[.]com, and recommends continuing toward an enforceable allow list and behavior-based detections.
Article Details
- Event Type
- Step Security announced deny-list egress policies for Harden-Runner.
- Impact
- The feature blocks specified domains or IP addresses while leaving unlisted destinations reachable. It is available in Harden-Runner GitHub Action v2.21.0, Self-Hosted VM Harden Runner v1.9.0, and ARC Harden Runner v2.19.0 through the Policy Store or supported configuration inputs. It can prevent CI jobs from bypassing Secure Registry by connecting directly to public package registries, but it does not provide allow-list coverage for unanticipated destinations or stop exfiltration to destinations that must remain reachable.
Vendors
Products
GitHub ActionsNot sure what your runners are contacting today? Run a free GitHub Actions Audit across your organization.Harden-RunnerDeny lists close that gap. The Harden-Runner GitHub Action v2.21.0 adds a denied-endpoints input that blocks the destinations you list and leaves everything else reachable.Secure RegistryIf you have deployed Secure Registry, your package clients are configured to install through it, so every metadata request and download is evaluated against your cooldown, compromised-package, and block-list controls