Detections

Available for Enterprise Tier only

Harden-Runner can monitor outbound runtime detections to help you stay informed about security risks in your GitHub Actions workflows. You can review all past runtime detections on the Detections page under the Harden-Runner menu.

The Detections page covers five critical areas:

1. Secrets in Build Logs

2. Secrets in Artifacts

3. Outbound Calls Blocked

4. Anomalous Outbound Network Calls

5. Source Code Overwritten

Each detection is linked to the relevant GitHub Actions workflow and run and includes direct links to the run and the insights URL that indicates where the detection happened.

1. Secrets in Build Logs: This section shows secrets (API keys, tokens, etc.) that were accidentally logged.

StepSecurity All Detections page showing secrets in build logs

Example: A Slack webhook URL was logged in load_tests_int.yml.

StepSecurity Insights control page

1. Secrets in Artifacts: Detects secrets found in generated artifacts.

StepSecurity All Detections page showing secrets in artifacts

Example: A JWT token was found in jwt-artifact1

StepSecurity Insights control page

1. Outbound Calls Blocked: Shows network requests that were blocked to prevent security risks.

StepSecurity All Detections page showing Outbound Calls Blocked

Example: A workflow tried to access www.google.com, but it was blocked because it was not part of the baseline

StepSecurity Insights Network Events page

1. Anomalous Outbound Network Calls: Lists unusual or unexpected external network requests.

StepSecurity All Detections page showing Anomalous Outbound Network Calls

1. Source Code Overwritten: Tracks files modified during workflows to detect unauthorized changes.

StepSecurity All Detections page showing files with Source Code Overwritten

Example: go.mod was changed in int-release.yml

StepSecurity Insights File Write Events page

Real-Time Security Alerts

StepSecurity delivers real-time alerts for runtime detections, ensuring you stay informed about potential security threats as they happen.

To minimize alert fatigue, notifications are sent only once per event, covering all repositories in your GitHub organization. This approach maintains visibility into security events without overwhelming your team.

Follow the instructions in Notification Settings to configure your alerts.