Skip to content
SPECIFICTION
Get listed

StepSecurity

stepsecurity.io

From $8/mo Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit stepsecurity.io
Spec score 7.9 #12 of 24 in Software Supply Chain Security Software

What it is

StepSecurity is a software supply chain security platform spanning developer environments, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then relates activity to workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines. Secure Registry provides package cooldowns, blocks compromised versions, and offers typosquat protection and blocklists. Code Repo Security screens pull requests and can open remediation pull requests according to policies. Security alerts can go to email, Slack, or Microsoft Teams. Dev Machine Guard can be deployed without an agent through Intune, SCCM, or Jamf on macOS, Windows, and Linux. The Community plan is free for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day trial. Dev Machine Guard costs $8 a month per device, while Enterprise costs $16 a month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance.

Spec sheet

Product
StepSecurity detects, prevents, and responds to software supply chain attacks across developer environments, code repositories, and CI/CD pipelines.Read 3 Oct 2026 · docs.stepsecurity.io
Intended users
StepSecurity describes its full platform as serving contributing developers and offers Dev Machine Guard for employees who use development tools but do not contribute code.Read 3 Oct 2026 · stepsecurity.io
Integrations
The pricing page lists GitLab CI, Azure DevOps, JFrog Artifactory, Sonatype Nexus, and Google Artifact Registry compatibility.Read 3 Oct 2026 · stepsecurity.io
Support
The Community plan includes community support, while Enterprise and Dev Machine Guard list priority support.Read 3 Oct 2026 · stepsecurity.io
Company
The company page identifies Varun Sharma as CEO and co-founder and Ashish Kurmi as CTO and co-founder.Read 3 Oct 2026 · stepsecurity.io
CI/CD monitoring
Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, correlating events to workflow steps.Read 3 Oct 2026 · docs.stepsecurity.io
Developer machine inventory
Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines.Read 3 Oct 2026 · stepsecurity.io
Notable limits
The free Community plan is for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day free trial.Read 3 Oct 2026 · stepsecurity.io
Notifications
Security event notifications can be sent by email, Slack, or Microsoft Teams.Read 3 Oct 2026 · docs.stepsecurity.io
Operating systems
The pricing page lists agentless Dev Machine Guard deployment through Intune, SCCM, or Jamf on macOS, Windows, and Linux.Read 3 Oct 2026 · stepsecurity.io
Package protection
Secure Registry provides cooldown periods, compromised-version blocking, typosquat protection, and package blocklists.Read 3 Oct 2026 · stepsecurity.io
Repository controls
Code Repo Security screens pull requests and can open policy-driven remediation pull requests across repositories.Read 3 Oct 2026 · stepsecurity.io
Security compliance
The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance and provides audit and penetration testing reports.Read 3 Oct 2026 · trust.stepsecurity.io

Plans and prices

Community Free Free Unlimited public repositories · GitHub-hosted runners on GitHub Cloud · Community support Read 3 Oct 2026 · stepsecurity.io
Dev Machine Guard $8 a month $8 /month per device Device and registry protection · Includes Secure Registry · For employees who do not contribute code Read 3 Oct 2026 · stepsecurity.io
Enterprise $16 a month $16 /month per contributing developer Full platform · Includes Dev Machine Guard and Secure Registry · Priority support with support SLAs Read 3 Oct 2026 · stepsecurity.io

Every StepSecurity plan and price →

Strong points and limits

Strong points

  • Harden-Runner links monitored activity to workflow steps
  • Secure Registry blocks compromised versions and typosquats
  • Code Repo Security can open policy-driven remediation pull requests
  • Alerts can go to email, Slack, or Microsoft Teams
  • Dev Machine Guard supports agentless deployment on three operating systems

Limits

  • Free Community plan is for public repositories
  • Free plan lists GitHub-hosted runners on GitHub Cloud
  • Private repositories are included only in the 14-day trial

Who it suits

StepSecurity suits teams seeking supply chain security across developer machines, repositories, and CI/CD pipelines. Dev Machine Guard is also presented for employees who use development tools but do not contribute code.

Verdict

StepSecurity covers developer machines, repositories, and CI/CD workflows with separate protections for packages and pull requests. The free Community offering has public-repository limits; Dev Machine Guard and Enterprise have per-device or per-developer pricing.

Where Specifiction places it

Alternatives to StepSecurityAll alternatives →