StepSecurity addresses software supply chain risks across developer machines, code repositories, and CI/CD pipelines. Harden-Runner uses eBPF to monitor network calls, file writes, and process executions, then relates those events to workflow steps. Dev Machine Guard inventories AI coding agents, MCP servers, IDE extensions, and local packages on developer devices. Secure Registry offers package cooldowns, blocking for compromised versions, typosquat protection, and blocklists. Code Repo Security screens pull requests and can open remediation pull requests based on policies. Event alerts can be sent by email, Slack, or Microsoft Teams. Dev Machine Guard supports agentless deployment through Intune, SCCM, or Jamf on macOS, Windows, and Linux. The free Community plan covers unlimited public repositories and lists GitHub-hosted runners on GitHub Cloud; private repositories are included in the 14-day trial. Dev Machine Guard is 8.00 USD per month per device, and Enterprise is 16.00 USD per month per contributing developer. The Trust Center lists SOC 2 Type 2 and ISO 27001:2022 compliance. Community includes community support; Enterprise and Dev Machine Guard list priority support.
Who it is for
StepSecurity suits teams seeking controls across development machines, repositories, and CI/CD pipelines. Dev Machine Guard is also presented for employees who use development tools but do not contribute code.
What is good
- Monitors workflow activity with eBPF.
- Inventories developer tools and local packages.
- Provides package cooldowns and typosquat protection.
- Sends alerts by email, Slack, or Microsoft Teams.
- Lists SOC 2 Type 2 and ISO 27001:2022 compliance.
What to know first
- Free Community is limited to public repositories.
- Community lists GitHub-hosted runners on GitHub Cloud.
- Private repositories are included in the 14-day trial.
Verdict
StepSecurity combines developer-device inventories, repository controls, and CI/CD monitoring. The free plan is scoped to public repositories, while device and enterprise offerings have per-device or per-developer prices.
StepSecurity plans and pricing
All plansCompared on software supply chain security software
- Free plan
- Yes
- Source & repo security
- Yes
- Dependency analysis
- Yes
- Provenance attestations
- Yes
- Release policy gates
- Yes
