ActiveState Platform vs StepSecurity

ActiveState Platform hosts custom runtimes assembled from source. Projects specify runtime components, preserve project history and provide deployment instructions; their artifacts may include packages, dependencies, patches and bundles, but not contributors’ first-party code. Create projects in the web interface or with the State Tool CLI, then deploy and activate them locally. Projects can remain personal, be shared with an organization or be public. The platform supports Windows, macOS and Linux deployments, and its GraphQL API can build open-source software for different operating systems and languages without requiring users to manage build infrastructure. It provides immutable SBOMs in SPDX formats and describes build safeguards including reproducible builds, checksum checks and isolated containers. A free organization plan costs nothing and is limited to public projects. Curated Catalog annual pricing is $25,000 for fewer than 100 employees, $50,000 for 100–999 employees and $150,000 for 1,000 or more; those prices do not apply to legacy Platform subscriptions.

StepSecurity is a software supply chain security platform spanning developer environments, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then relates activity to workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer machines. Secure Registry provides package cooldowns, blocks compromised versions, and offers typosquat protection and blocklists. Code Repo Security screens pull requests and can open remediation pull requests according to policies. Security alerts can go to email, Slack, or Microsoft Teams. Dev Machine Guard can be deployed without an agent through Intune, SCCM, or Jamf on macOS, Windows, and Linux. The Community plan is free for unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day trial. Dev Machine Guard costs $8 a month per device, while Enterprise costs $16 a month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance.