Overview

Available for Enterprise Tier users only

After you install the StepSecurity Actions Security GitHub App in your GitHub Account and access your dashboard, you should see the dashboard Oveview page.

On this page, you can see all the controls enabled by StepSecurity.

Overview page

These controls are specific checks on your GitHub organization workflows to ensure compliance with industry-standard security practices, all of which StepSecurity provides.

Key Metrics

• View the control's name, compliance status, severity status, and failed check metrics for workflows.

• Remediate any failed controls via automation by creating a PR.

How to Remediate a Failed Security Check

After StepSecurity checks your organization's workflows, Harden Runner may discover harmful practices affecting your security compliance status. To fix this:

1. Click on a control with a Failed compliance status.

   
2. You can view the control's details and click the "Link to build log" to view the evidence of the security flaw.

   

   The build log shows that permissions are granted to the GitHub Token that are more than required.

3. Click "Open a Fix PR" to fix the issue.

   

4. You'll be redirected to the "Orchestrate Security" tab, where the security issues in the repo are analyzed. You can then proceed to click the "Create Pull Request" button.

   
5. A Pull Request is created to address the issues. Proceed to merge the PR to resolve all workflow security issues.