# StepSecurity

## GitHub Actions

- [Introduction](https://docs.stepsecurity.io/start-here/readme.md)
- [Guides](https://docs.stepsecurity.io/start-here/guides.md)
- [Deploying Harden-Runner on GitHub-hosted runners](https://docs.stepsecurity.io/start-here/guides/deploying-harden-runner-on-github-hosted-runners.md)
- [How to enable network and runtime monitoring (Harden-Runner) for runners](https://docs.stepsecurity.io/start-here/guides/how-to-enable-network-and-runtime-monitoring-harden-runner-for-runners.md)
- [How to restrict network connections to explicitly allowed endpoints](https://docs.stepsecurity.io/start-here/guides/how-to-restrict-network-connections-to-explicitly-allowed-endpoints.md)
- [How do I authenticate with the StepSecurity app](https://docs.stepsecurity.io/start-here/guides/how-do-i-authenticate-with-the-stepsecurity-app.md)
- [How should I improve the security of third-party actions in my organization](https://docs.stepsecurity.io/start-here/guides/how-should-i-improve-the-security-of-third-party-actions-in-my-organization.md)
- [How should I reduce the number of Harden-Runner anomalous endpoint alerts](https://docs.stepsecurity.io/start-here/guides/how-should-i-reduce-the-number-of-harden-runner-anomalous-endpoint-alerts.md)
- [How can developers see and fix StepSecurity findings without security’s help?](https://docs.stepsecurity.io/start-here/guides/how-can-developers-see-and-fix-stepsecurity-findings-without-securitys-help.md)
- [How to Respond to a Compromised npm Package in Your Organization](https://docs.stepsecurity.io/start-here/guides/how-to-respond-to-a-compromised-npm-package-in-your-organization.md)
- [How to Fix a Blocked Endpoint in Your Workflow](https://docs.stepsecurity.io/start-here/guides/how-to-fix-a-blocked-endpoint-in-your-workflow.md)
- [Developer Experience](https://docs.stepsecurity.io/by-role/developer-experience.md)
- [StepSecurity PRs](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-prs.md)
- [StepSecurity GitHub Checks](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-github-checks.md)
- [StepSecurity Workflow Run Policies](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-workflow-run-policies.md)
- [StepSecurity Maintained Actions](https://docs.stepsecurity.io/by-role/developer-experience/stepsecurity-maintained-actions.md)
- [Admin Experience](https://docs.stepsecurity.io/by-role/admin-experience.md)
- [Security Engineer Experience](https://docs.stepsecurity.io/by-role/security-engineer-experience.md)
- [Getting Started](https://docs.stepsecurity.io/workspace/getting-started.md)
- [Quickstart (Community Tier)](https://docs.stepsecurity.io/workspace/getting-started/quickstart-community-tier.md)
- [Quickstart (Enterprise Tier)](https://docs.stepsecurity.io/workspace/getting-started/quickstart-enterprise-tier.md)
- [Overview](https://docs.stepsecurity.io/workspace/overview.md)
- [Detections](https://docs.stepsecurity.io/workspace/detections.md)
- [Threat Center](https://docs.stepsecurity.io/workspace/threat-center.md)
- [Reports](https://docs.stepsecurity.io/workspace/reports.md)
- [Harden-Runner](https://docs.stepsecurity.io/workspace/reports/harden-runner.md)
- [Actions Governance](https://docs.stepsecurity.io/workspace/reports/actions-governance.md)
- [Export to PDF](https://docs.stepsecurity.io/workspace/reports/export-to-pdf.md)
- [Settings](https://docs.stepsecurity.io/workspace/settings.md)
- [Notifications](https://docs.stepsecurity.io/workspace/settings/notifications.md)
- [StepSecurity API (Org Access)](https://docs.stepsecurity.io/workspace/settings/stepsecurity-api-org-access.md)
- [Control Evaluation](https://docs.stepsecurity.io/workspace/settings/control-evaluation.md)
- [Harden-Runner](https://docs.stepsecurity.io/github-actions/harden-runner.md)
- [Workflow Runs](https://docs.stepsecurity.io/github-actions/harden-runner/workflow-runs.md)
- [Baseline](https://docs.stepsecurity.io/github-actions/harden-runner/baseline.md)
- [Suppression Rules](https://docs.stepsecurity.io/github-actions/harden-runner/suppression-rules.md)
- [Policy Store](https://docs.stepsecurity.io/github-actions/harden-runner/policy-store.md)
- [Self-Hosted Runners](https://docs.stepsecurity.io/github-actions/harden-runner/self-hosted-runners.md)
- [Harden Runner Installation](https://docs.stepsecurity.io/github-actions/harden-runner/harden-runner-installation.md)
- [Runbooks](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks.md)
- [Investigating Anomalous Outbound Network Calls](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/investigating-anomalous-outbound-network-calls.md)
- [How to Determine Minimum Token Permissions](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/how-to-determine-minimum-token-permissions.md)
- [Triaging Action Uses Imposter Commit](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-action-uses-imposter-commit.md)
- [Triaging Runner.Worker Memory Read](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-runner.worker-memory-read.md)
- [Triaging Reverse Shell](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-reverse-shell.md)
- [Triaging Privileged Container](https://docs.stepsecurity.io/github-actions/harden-runner/runbooks/triaging-privileged-container.md)
- [Actions](https://docs.stepsecurity.io/github-actions/actions.md)
- [GitHub Actions In Use](https://docs.stepsecurity.io/github-actions/actions/github-actions-in-use.md)
- [Reusable Workflows](https://docs.stepsecurity.io/github-actions/actions/reusable-workflows.md)
- [GitHub Actions Advisor](https://docs.stepsecurity.io/github-actions/actions/github-actions-advisor.md)
- [Action Requests](https://docs.stepsecurity.io/github-actions/actions/action-requests.md)
- [Workflow Run Policies](https://docs.stepsecurity.io/github-actions/workflow-run-policies.md)
- [Policies](https://docs.stepsecurity.io/github-actions/workflow-run-policies/policies.md)
- [Policy Evaluations](https://docs.stepsecurity.io/github-actions/workflow-run-policies/policy-evaluations.md)
- [Actions Secret](https://docs.stepsecurity.io/github-actions/actions-secret.md)
- [GitHub Checks](https://docs.stepsecurity.io/github/github-checks.md)
- [Configuration](https://docs.stepsecurity.io/github/github-checks/configuration.md)
- [Checks](https://docs.stepsecurity.io/github/github-checks/checks.md)
- [Orchestrate Security](https://docs.stepsecurity.io/github/orchestrate-security.md)
- [Policy Driven PRs](https://docs.stepsecurity.io/github/orchestrate-security/policy-driven-prs.md)
- [Pull Requests](https://docs.stepsecurity.io/github/orchestrate-security/pull-requests.md)
- [Secure Workflow](https://docs.stepsecurity.io/github/orchestrate-security/secure-workflow.md)
- [Secure Repo](https://docs.stepsecurity.io/github/orchestrate-security/secure-repo.md)
- [Apps & PATs](https://docs.stepsecurity.io/github/apps-and-pats.md)
- [OSS Package Search](https://docs.stepsecurity.io/packages/oss-package-search.md)
- [OSS Security Feed](https://docs.stepsecurity.io/packages/oss-security-feed.md)
- [Secure Registry](https://docs.stepsecurity.io/packages/secure-registry.md)
- [Policy](https://docs.stepsecurity.io/packages/secure-registry/policy.md)
- [Policy Evaluations](https://docs.stepsecurity.io/packages/secure-registry/policy-evaluations.md)
- [Setup Guide](https://docs.stepsecurity.io/packages/secure-registry/setup-guide.md)
- [Devices](https://docs.stepsecurity.io/developer-machines/devices.md)
- [IDE Extensions](https://docs.stepsecurity.io/developer-machines/ide-extensions.md)
- [IDE & AI Agents](https://docs.stepsecurity.io/developer-machines/ide-and-ai-agents.md)
- [MCP Servers](https://docs.stepsecurity.io/developer-machines/mcp-servers.md)
- [Agent Skills](https://docs.stepsecurity.io/developer-machines/agent-skills.md)
- [Suspicious Files](https://docs.stepsecurity.io/developer-machines/suspicious-files.md)
- [Packages](https://docs.stepsecurity.io/developer-machines/packages.md)
- [OSS Packages](https://docs.stepsecurity.io/developer-machines/packages/oss-packages.md)
- [System Packages](https://docs.stepsecurity.io/developer-machines/packages/system-packages.md)
- [Package Configs](https://docs.stepsecurity.io/developer-machines/packages/package-configs.md)
- [Device Policy](https://docs.stepsecurity.io/developer-machines/device-policy.md)
- [Policies](https://docs.stepsecurity.io/developer-machines/device-policy/policies.md)
- [Profiles](https://docs.stepsecurity.io/developer-machines/device-policy/profiles.md)
- [Installation](https://docs.stepsecurity.io/developer-machines/installation.md)
- [Script](https://docs.stepsecurity.io/developer-machines/installation/script.md)
- [MDM Deployment](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment.md)
- [Windows](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows.md)
- [Microsoft Configuration Manager (SCCM)](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows/microsoft-configuration-manager-sccm.md)
- [Microsoft Intune](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/windows/microsoft-intune.md)
- [macOS](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos.md)
- [Iru (formerly Kandji)](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos/iru-formerly-kandji.md)
- [launchd Troubleshooting](https://docs.stepsecurity.io/developer-machines/installation/script/mdm-deployment/macos/launchd-troubleshooting.md)
- [Settings](https://docs.stepsecurity.io/developer-machines/installation/settings.md)
- [Admin Console](https://docs.stepsecurity.io/administration/admin-console.md)
- [Resources](https://docs.stepsecurity.io/administration/admin-console/resources.md)
- [GitHub Cloud Organizations](https://docs.stepsecurity.io/administration/admin-console/resources/github-cloud-organizations.md)
- [GitHub Enterprise Servers](https://docs.stepsecurity.io/administration/admin-console/resources/github-enterprise-servers.md)
- [Gitlab Servers](https://docs.stepsecurity.io/administration/admin-console/resources/gitlab-servers.md)
- [Azure DevOps Organizations](https://docs.stepsecurity.io/administration/admin-console/resources/azure-devops-organizations.md)
- [Dev Machine Guard](https://docs.stepsecurity.io/administration/admin-console/resources/dev-machine-guard.md)
- [Integrations](https://docs.stepsecurity.io/administration/admin-console/integrations.md)
- [S3 Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/s3-integration.md)
- [Webhook Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/webhook-integration.md)
- [Slack OAuth Integration](https://docs.stepsecurity.io/administration/admin-console/integrations/slack-oauth-integration.md)
- [StepSecurity API (Tenant Access)](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-api-tenant-access.md)
- [Terraform Provider](https://docs.stepsecurity.io/administration/admin-console/integrations/terraform-provider.md)
- [StepSecurity MCP Server](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-mcp-server.md)
- [StepSecurity GitHub Apps](https://docs.stepsecurity.io/administration/admin-console/integrations/stepsecurity-github-apps.md)
- [Sample Detection Events](https://docs.stepsecurity.io/administration/admin-console/integrations/sample-detection-events.md)
- [Access Control](https://docs.stepsecurity.io/administration/admin-console/access-control.md)
- [Members](https://docs.stepsecurity.io/administration/admin-console/access-control/members.md)
- [Roles](https://docs.stepsecurity.io/administration/admin-console/access-control/roles.md)
- [Security & Auth](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth.md)
- [Setting up Auth0 SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-auth0-sso.md)
- [Setting Up Google SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-google-sso.md)
- [Setting Up Okta SSO](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-okta-sso.md)
- [Setting Up Microsoft Entra (Azure AD)](https://docs.stepsecurity.io/administration/admin-console/access-control/security-and-auth/setting-up-microsoft-entra-azure-ad.md)
- [Audit Logs](https://docs.stepsecurity.io/administration/admin-console/audit-logs.md)
- [Reports](https://docs.stepsecurity.io/administration/admin-console/reports.md)
- [Settings](https://docs.stepsecurity.io/administration/admin-console/settings.md)
- [Anomaly Detection](https://docs.stepsecurity.io/administration/admin-console/settings/anomaly-detection.md)
- [GitHub Job Summary](https://docs.stepsecurity.io/administration/admin-console/settings/github-job-summary.md)
- [User Settings](https://docs.stepsecurity.io/administration/user-settings.md)
- [Personal Access Token](https://docs.stepsecurity.io/administration/user-settings/personal-access-token.md)
- [Workflow Templates](https://docs.stepsecurity.io/administration/user-settings/workflow-templates.md)
- [Orchestrate Options](https://docs.stepsecurity.io/administration/user-settings/orchestrate-options.md)
- [Pull Request](https://docs.stepsecurity.io/administration/user-settings/pull-request.md)
- [Short-lived tokens](https://docs.stepsecurity.io/administration/short-lived-tokens.md)
- [Changelog](https://docs.stepsecurity.io/resources/changelog.md)
- [Enterprise Readiness](https://docs.stepsecurity.io/resources/enterprise-readiness.md)
- [Partnerships](https://docs.stepsecurity.io/resources/partnerships.md)
- [RunsOn](https://docs.stepsecurity.io/resources/partnerships/runson.md)
- [Who's Using Harden-Runner?](https://docs.stepsecurity.io/resources/whos-using-harden-runner.md)

## GitLab CI

- [Introduction](https://docs.stepsecurity.io/gitlab/introduction.md)
- [Harden Runner](https://docs.stepsecurity.io/gitlab/harden-runner.md)
- [Pipeline Runs](https://docs.stepsecurity.io/gitlab/harden-runner/pipeline-runs.md)
- [Baseline](https://docs.stepsecurity.io/gitlab/harden-runner/baseline.md)
- [All Destinations](https://docs.stepsecurity.io/gitlab/harden-runner/all-destinations.md)
- [Detections](https://docs.stepsecurity.io/gitlab/harden-runner/detections.md)
- [Suppression Rules](https://docs.stepsecurity.io/gitlab/harden-runner/suppression-rules.md)
- [Agent Status](https://docs.stepsecurity.io/gitlab/harden-runner/agent-status.md)
- [Settings](https://docs.stepsecurity.io/gitlab/settings.md)
- [Notifications](https://docs.stepsecurity.io/gitlab/settings/notifications.md)
- [Self-Hosted Runners](https://docs.stepsecurity.io/gitlab/settings/self-hosted-runners.md)

## Azure DevOps

- [Introduction](https://docs.stepsecurity.io/azure-devops/introduction.md)
- [Harden Runner](https://docs.stepsecurity.io/azure-devops/harden-runner.md)
- [Pipeline Runs](https://docs.stepsecurity.io/azure-devops/harden-runner/pipeline-runs.md)
- [Baseline](https://docs.stepsecurity.io/azure-devops/harden-runner/baseline.md)
- [Detections](https://docs.stepsecurity.io/azure-devops/harden-runner/detections.md)
- [Suppression Rules](https://docs.stepsecurity.io/azure-devops/harden-runner/suppression-rules.md)
- [Admin Console](https://docs.stepsecurity.io/azure-devops/admin-console.md)
- [Settings](https://docs.stepsecurity.io/azure-devops/settings.md)

## OSS Supply Chain Security

- [Introduction](https://docs.stepsecurity.io/oss-supply-chain-security/introduction.md)
- [Prevent](https://docs.stepsecurity.io/oss-supply-chain-security/prevent.md)
- [Detect](https://docs.stepsecurity.io/oss-supply-chain-security/detect.md)
- [Respond](https://docs.stepsecurity.io/oss-supply-chain-security/respond.md)
- [Case Study](https://docs.stepsecurity.io/oss-supply-chain-security/case-study.md)

## Dev Machine Guard

- [Overview](https://docs.stepsecurity.io/dev-machine-guard/overview.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on a page URL with the `ask` query parameter:
```
GET https://docs.stepsecurity.io/start-here/readme.md?ask=<question>
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.