# StepSecurity

## GitHub Actions

- [Introduction](https://docs.stepsecurity.io/start-here/readme.md)
- [Guides](https://docs.stepsecurity.io/start-here/guides.md)
- [Deploying Harden-Runner on GitHub-hosted runners](https://docs.stepsecurity.io/start-here/guides/deploying-harden-runner-on-github-hosted-runners.md)
- [How to enable network and runtime monitoring (Harden-Runner) for runners](https://docs.stepsecurity.io/start-here/guides/how-to-enable-network-and-runtime-monitoring-harden-runner-for-runners.md)
- [How to restrict network connections to explicitly allowed endpoints](https://docs.stepsecurity.io/start-here/guides/how-to-restrict-network-connections-to-explicitly-allowed-endpoints.md)
- [How do I authenticate with the StepSecurity app](https://docs.stepsecurity.io/start-here/guides/how-do-i-authenticate-with-the-stepsecurity-app.md)
- [How should I improve the security of third-party actions in my organization](https://docs.stepsecurity.io/start-here/guides/how-should-i-improve-the-security-of-third-party-actions-in-my-organization.md)
- [How should I reduce the number of Harden-Runner anomalous endpoint alerts](https://docs.stepsecurity.io/start-here/guides/how-should-i-reduce-the-number-of-harden-runner-anomalous-endpoint-alerts.md)
- [How can developers see and fix StepSecurity findings without security’s help?](https://docs.stepsecurity.io/start-here/guides/how-can-developers-see-and-fix-stepsecurity-findings-without-securitys-help.md)
- [How to Respond to a Compromised Package in Your Organization](https://docs.stepsecurity.io/start-here/guides/how-to-respond-to-a-compromised-npm-package-in-your-organization.md)
- [How to Fix a Blocked Endpoint in Your Workflow](https://docs.stepsecurity.io/start-here/guides/how-to-fix-a-blocked-endpoint-in-your-workflow.md)
- [Developer Experience](https://docs.stepsecurity.io/by-role/developer-experience.md)
- [StepSecurity PRs](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-prs.md)
- [StepSecurity GitHub Checks](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-github-checks.md)
- [StepSecurity Workflow Run Policies](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-workflow-run-policies.md)
- [Admin Experience](https://docs.stepsecurity.io/by-role/admin-experience.md)
- [Security Engineer Experience](https://docs.stepsecurity.io/by-role/security-engineer-experience.md)
- [Getting Started](https://docs.stepsecurity.io/workspace/getting-started.md)
- [Quickstart (Community Tier)](https://docs.stepsecurity.io/workspace/getting-started/quickstart-community-tier.md)
- [Quickstart (Enterprise Tier)](https://docs.stepsecurity.io/workspace/getting-started/quickstart-enterprise-tier.md)
- [Overview](https://docs.stepsecurity.io/workspace/overview.md)
- [Detections](https://docs.stepsecurity.io/workspace/detections.md)
- [Threat Center](https://docs.stepsecurity.io/workspace/threat-center.md)
- [Reports](https://docs.stepsecurity.io/workspace/reports.md)
- [Harden-Runner](https://docs.stepsecurity.io/workspace/reports/harden-runner.md)
- [Actions Governance](https://docs.stepsecurity.io/workspace/reports/actions-governance.md)
- [Export to PDF](https://docs.stepsecurity.io/workspace/reports/export-to-pdf.md)
- [Settings](https://docs.stepsecurity.io/workspace/settings.md)
- [Notifications](https://docs.stepsecurity.io/workspace/settings/notifications.md)
- [StepSecurity API (Org Access)](https://docs.stepsecurity.io/workspace/settings/stepsecurity-api-org-access.md)
- [Control Evaluation](https://docs.stepsecurity.io/workspace/settings/control-evaluation.md)
- [Harden-Runner](https://docs.stepsecurity.io/github-actions/harden-runner.md)
- [Workflow Runs](https://docs.stepsecurity.io/github-actions/harden-runner/workflow-runs.md)
- [Baseline](https://docs.stepsecurity.io/github-actions/harden-runner/baseline.md)
- [Suppression Rules](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules.md)
- [Policy Store](https://docs.stepsecurity.io/github-actions/harden-runner/policy-store.md)
- [Self-Hosted Runners](https://docs.stepsecurity.io/github-actions/harden-runner/self-hosted-runners.md)
- [Installation](https://docs.stepsecurity.io/github-actions/harden-runner/harden-runner-installation.md)
- [Runner Job Hooks](https://docs.stepsecurity.io/github-actions/harden-runner/harden-runner-installation/runner-job-hooks.md)
- [Runbooks](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks.md)
- [Investigating Anomalous Outbound Network Calls](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/investigating-anomalous-outbound-network-calls.md)
- [How to Determine Minimum Token Permissions](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/how-to-determine-minimum-token-permissions.md)
- [Triaging Action Uses Imposter Commit](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-action-uses-imposter-commit.md)
- [Triaging Runner.Worker Memory Read](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-runner.worker-memory-read.md)
- [Triaging Reverse Shell](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-reverse-shell.md)
- [Triaging Privileged Container](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-privileged-container.md)
- [Actions](https://docs.stepsecurity.io/github-actions/actions.md)
- [GitHub Actions In Use](https://docs.stepsecurity.io/github-actions/actions/github-actions-in-use.md)
- [Reusable Workflows](https://docs.stepsecurity.io/github-actions/actions/reusable-workflows.md)
- [GitHub Actions Advisor](https://docs.stepsecurity.io/github-actions/actions/github-actions-advisor.md)
- [StepSecurity Maintained Actions](https://docs.stepsecurity.io/github-actions/actions/stepsecurity-maintained-actions.md)
- [Action Requests](https://docs.stepsecurity.io/github-actions/actions/action-requests.md)
- [Workflow Run Policies](https://docs.stepsecurity.io/github-actions/workflow-run-policies.md)
- [Policies](https://docs.stepsecurity.io/github-actions/workflow-run-policies/policies.md)
- [Policy Evaluations](https://docs.stepsecurity.io/github-actions/workflow-run-policies/policy-evaluations.md)
- [Actions Secret](https://docs.stepsecurity.io/github-actions/actions-secret.md)
- [GitHub Checks](https://docs.stepsecurity.io/github/github-checks.md)
- [Configuration](https://docs.stepsecurity.io/github/github-checks/configuration.md)
- [Checks](https://docs.stepsecurity.io/github/github-checks/checks.md)
- [Orchestrate Security](https://docs.stepsecurity.io/github/orchestrate-security.md)
- [Policy Driven PRs](https://docs.stepsecurity.io/github/orchestrate-security/policy-driven-prs.md)
- [Pull Requests](https://docs.stepsecurity.io/github/orchestrate-security/pull-requests.md)
- [Secure Workflow](https://docs.stepsecurity.io/github/orchestrate-security/secure-workflow.md)
- [Secure Repo](https://docs.stepsecurity.io/github/orchestrate-security/secure-repo.md)
- [Apps & PATs](https://docs.stepsecurity.io/github/apps-and-pats.md)
- [Agent Skills](https://docs.stepsecurity.io/github/agent-skills.md)
- [Audit Log](https://docs.stepsecurity.io/github/audit-log.md)
- [OSS Package Search](https://docs.stepsecurity.io/packages/oss-package-search.md)
- [OSS Security Feed](https://docs.stepsecurity.io/packages/oss-security-feed.md)
- [Secure Registry](https://docs.stepsecurity.io/packages/secure-registry.md)
- [Policy](https://docs.stepsecurity.io/packages/secure-registry/policy.md)
- [Policy Evaluations](https://docs.stepsecurity.io/packages/secure-registry/policy-evaluations.md)
- [Setup Guide](https://docs.stepsecurity.io/packages/secure-registry/setup-guide.md)
- [Service Level Agreement](https://docs.stepsecurity.io/packages/secure-registry/service-level-agreement.md)
- [Devices](https://docs.stepsecurity.io/developer-machines/devices.md)
- [Browser Extensions](https://docs.stepsecurity.io/developer-machines/browser-extensions.md)
- [Credentials](https://docs.stepsecurity.io/developer-machines/credentials.md)
- [IDE & AI Agents](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents.md)
- [Coding Tools](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/coding-tools.md)
- [IDE Extensions](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/ide-extensions.md)
- [Extension Advisor](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/extension-advisor.md)
- [Agent Plugins](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/agent-plugins.md)
- [MCP Servers](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/mcp-servers.md)
- [Agent Skills](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents/agent-skills.md)
- [Suspicious Files](https://docs.stepsecurity.io/developer-machines/suspicious-files.md)
- [Packages](https://docs.stepsecurity.io/developer-machines/packages.md)
- [OSS Packages](https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md)
- [System Packages](https://docs.stepsecurity.io/developer-machines/packages/system-packages.md)
- [Package Configs](https://docs.stepsecurity.io/developer-machines/packages/package-configs.md)
- [Device Policy](https://docs.stepsecurity.io/developer-machines/device-policy.md)
- [Policies](https://docs.stepsecurity.io/developer-machines/device-policy/policies.md)
- [Profiles](https://docs.stepsecurity.io/developer-machines/device-policy/profiles.md)
- [Installation](https://docs.stepsecurity.io/developer-machines/installation.md)
- [Script](https://docs.stepsecurity.io/developer-machines/installation/script.md)
- [MDM Deployment](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment.md)
- [Windows](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows.md)
- [Microsoft Configuration Manager (SCCM)](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows/microsoft-configuration-manager-sccm.md)
- [Microsoft Intune](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows/microsoft-intune.md)
- [macOS](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos.md)
- [Iru (formerly Kandji)](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos/iru-formerly-kandji.md)
- [launchd Troubleshooting](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos/launchd-troubleshooting.md)
- [Settings](https://docs.stepsecurity.io/developer-machines/installation/settings.md)
- [Admin Console](https://docs.stepsecurity.io/administration/admin-console.md)
- [Resources](https://docs.stepsecurity.io/administration/admin-console/resources.md)
- [GitHub Cloud Organizations](https://docs.stepsecurity.io/administration/admin-console/resources/github-cloud-organizations.md)
- [GitHub Enterprise Servers](https://docs.stepsecurity.io/administration/admin-console/resources/github-enterprise-servers.md)
- [Gitlab Servers](https://docs.stepsecurity.io/administration/admin-console/resources/gitlab-servers.md)
- [Azure DevOps Organizations](https://docs.stepsecurity.io/administration/admin-console/resources/azure-devops-organizations.md)
- [Dev Machine Guard](https://docs.stepsecurity.io/administration/admin-console/resources/dev-machine-guard.md)
- [Integrations](https://docs.stepsecurity.io/administration/admin-console/integrations.md)
- [S3 Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/s3-integration.md)
- [Webhook Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/webhook-integration.md)
- [Slack OAuth Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/slack-oauth-integration.md)
- [StepSecurity API (Tenant Access)](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-api-tenant-access.md)
- [Terraform Provider](https://docs.stepsecurity.io/administration/admin-console/integrations/terraform-provider.md)
- [StepSecurity MCP Server](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-mcp-server.md)
- [StepSecurity GitHub Apps](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-github-apps.md)
- [Sample Detection Events](https://docs.stepsecurity.io/administration/admin-console/integrations/sample-detection-events.md)
- [Access Control](https://docs.stepsecurity.io/administration/admin-console/access-control.md)
- [Members](https://docs.stepsecurity.io/administration/admin-console/access-control/members.md)
- [Roles](https://docs.stepsecurity.io/administration/admin-console/access-control/roles.md)
- [Security & Auth](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth.md)
- [Setting up Auth0 SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-auth0-sso.md)
- [Setting Up Google SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-google-sso.md)
- [Setting Up Okta SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-okta-sso.md)
- [Setting Up Microsoft Entra (Azure AD)](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-microsoft-entra-azure-ad.md)
- [Audit Logs](https://docs.stepsecurity.io/administration/admin-console/audit-logs.md)
- [Reports](https://docs.stepsecurity.io/administration/admin-console/reports.md)
- [Settings](https://docs.stepsecurity.io/administration/admin-console/settings.md)
- [Anomaly Detection](https://docs.stepsecurity.io/administration/admin-console/settings/anomaly-detection.md)
- [GitHub Job Summary](https://docs.stepsecurity.io/administration/admin-console/settings/github-job-summary.md)
- [Notifications](https://docs.stepsecurity.io/administration/admin-console/settings/notifications.md)
- [User Settings](https://docs.stepsecurity.io/administration/user-settings.md)
- [Personal Access Token](https://docs.stepsecurity.io/administration/user-settings/personal-access-token.md)
- [Workflow Templates](https://docs.stepsecurity.io/administration/user-settings/workflow-templates.md)
- [Orchestrate Options](https://docs.stepsecurity.io/administration/user-settings/orchestrate-options.md)
- [Pull Request](https://docs.stepsecurity.io/administration/user-settings/pull-request.md)
- [Short-lived tokens](https://docs.stepsecurity.io/administration/short-lived-tokens.md)
- [Changelog](https://docs.stepsecurity.io/resources/changelog.md)
- [Enterprise Readiness](https://docs.stepsecurity.io/resources/enterprise-readiness.md)
- [GHES and GHEC Data Residency Feature Parity](https://docs.stepsecurity.io/resources/enterprise-readiness/ghes-and-ghec-data-residency-feature-parity.md)
- [Partnerships](https://docs.stepsecurity.io/resources/partnerships.md)
- [RunsOn](https://docs.stepsecurity.io/resources/partnerships/runson.md)
- [Who's Using Harden-Runner?](https://docs.stepsecurity.io/resources/whos-using-harden-runner.md)

## GitLab CI

- [Introduction](https://docs.stepsecurity.io/gitlab/introduction.md)
- [Harden Runner](https://docs.stepsecurity.io/gitlab/harden-runner.md)
- [Pipeline Runs](https://docs.stepsecurity.io/gitlab/harden-runner/pipeline-runs.md)
- [Baseline](https://docs.stepsecurity.io/gitlab/harden-runner/baseline.md)
- [All Destinations](https://docs.stepsecurity.io/gitlab/harden-runner/all-destinations.md)
- [Detections](https://docs.stepsecurity.io/gitlab/harden-runner/detections.md)
- [Suppression Rules](https://docs.stepsecurity.io/gitlab/harden-runner/suppression-rules.md)
- [Agent Status](https://docs.stepsecurity.io/gitlab/harden-runner/agent-status.md)
- [Settings](https://docs.stepsecurity.io/gitlab/settings.md)
- [Notifications](https://docs.stepsecurity.io/gitlab/settings/notifications.md)
- [Self-Hosted Runners](https://docs.stepsecurity.io/gitlab/settings/self-hosted-runners.md)

## Azure DevOps

- [Introduction](https://docs.stepsecurity.io/azure-devops/introduction.md)
- [Overview](https://docs.stepsecurity.io/azure-devops/overview.md)
- [Harden Runner](https://docs.stepsecurity.io/azure-devops/harden-runner.md)
- [Pipeline Runs](https://docs.stepsecurity.io/azure-devops/harden-runner/pipeline-runs.md)
- [Baseline](https://docs.stepsecurity.io/azure-devops/harden-runner/baseline.md)
- [Detections](https://docs.stepsecurity.io/azure-devops/harden-runner/detections.md)
- [Suppression Rules](https://docs.stepsecurity.io/azure-devops/harden-runner/suppression-rules.md)
- [Identities & PATs](https://docs.stepsecurity.io/azure-devops/identities-and-pats.md)
- [Admin Console](https://docs.stepsecurity.io/azure-devops/admin-console.md)
- [Settings](https://docs.stepsecurity.io/azure-devops/settings.md)
- [Notifications](https://docs.stepsecurity.io/azure-devops/settings/notifications.md)
- [Stepsecurity API](https://docs.stepsecurity.io/azure-devops/settings/stepsecurity-api.md)
- [Control Evaluation](https://docs.stepsecurity.io/azure-devops/settings/control-evaluation.md)

## OSS Supply Chain Security

- [Introduction](https://docs.stepsecurity.io/oss-supply-chain-security/introduction.md)
- [Prevent](https://docs.stepsecurity.io/oss-supply-chain-security/prevent.md)
- [Detect](https://docs.stepsecurity.io/oss-supply-chain-security/detect.md)
- [Respond](https://docs.stepsecurity.io/oss-supply-chain-security/respond.md)
- [Case Study](https://docs.stepsecurity.io/oss-supply-chain-security/case-study.md)

## Dev Machine Guard

- [Overview](https://docs.stepsecurity.io/dev-machine-guard/overview.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
This site has an agentic ask interface you may use to query the documentation dynamically by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stepsecurity.io/index.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.