step-security/harden-runner

• highreadme#1

  Reposition the README H1 to explicitly state its GitHub Actions focus

  原因：

  当前

  # Harden-Runner

  复制粘贴的修复

  复制

  # Harden-Runner: EDR for GitHub Actions Runners

  待办完成忽略
• mediumreadme#2

  Add a 'Key Differentiators' section to the README

  原因：

  复制粘贴的修复

  复制

  ## Key Differentiators
  Unlike generic EDRs or broader security platforms, Harden-Runner is purpose-built for CI/CD environments, specifically GitHub Actions. Its core differentiators include:
  - **Automatic Least-Privilege GITHUB_TOKEN:** Dynamically applies the minimum necessary permissions for the `GITHUB_TOKEN` at runtime.
  - **Tailored Network Egress Filtering:** Restricts outbound connections based on workflow needs, preventing data exfiltration.
  - **CI/CD Context Awareness:** Correlates security events directly with specific workflow runs, providing actionable insights.

  待办完成忽略
• lowexamples#3

  Add a section with concrete examples of threats Harden-Runner mitigates

  原因：

  复制粘贴的修复

  复制

  ## How Harden-Runner Mitigates Threats
  Harden-Runner actively protects against common CI/CD threats, including:
  - **Secret Exfiltration:** Blocks unauthorized outbound connections to prevent secrets from leaving your runner.
  - **Malicious Code Injection:** Detects unexpected process execution or file modifications.
  - **Supply Chain Compromise:** Monitors for suspicious activity that could indicate a compromised dependency.

  待办完成忽略

本次扫描解析到的品类 GEO 通道：google/gemini-2.5-flash, deepseek/deepseek-v4-flash

• 品类问题

  How can I secure GitHub Actions runners against runtime threats and monitor network egress?

  你：未被推荐
  AI 推荐顺序：

  1. Lacework
  2. Falco
  3. Wazuh
  4. Aqua Security
  5. Sysdig Secure
  6. Palo Alto Networks Prisma Cloud
  7. Cloudflare Gateway

  AI 推荐了 7 个替代方案，却始终没点名 step-security/harden-runner。这就是要补上的差距。

  查看 AI 完整回答
• 品类问题

  What are effective solutions for supply chain security monitoring in ephemeral CI/CD environments?

  你：未被推荐
  AI 推荐顺序：

  1. Aqua Security
  2. Snyk
  3. Anchore
  4. Tricentis
  5. GitLab Ultimate
  6. JFrog Xray
  7. Google Cloud's Assured Open Source Software
  8. Binary Authorization

  AI 推荐了 8 个替代方案，却始终没点名 step-security/harden-runner。这就是要补上的差距。

  查看 AI 完整回答

• Metadata completeness

  pass

• README presence

  pass

• Compared to common alternatives in this category, what is the core differentiator of step-security/harden-runner?

  pass
  ✓AI 明确点名了 step-security/harden-runner

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？

• If a team adopts step-security/harden-runner in production, what risks or prerequisites should they evaluate first?

  pass
  ✓AI 明确点名了 step-security/harden-runner

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？

• In one sentence, what problem does the repo step-security/harden-runner solve, and who is the primary audience?

  pass
  ✓AI 明确点名了 step-security/harden-runner

  AI 的回答可能信誓旦旦却是错的。请按事实核对：技术栈、目标人群、差异化点是不是和你实际的对得上？