Case Study: Recidiviz strengthens CI/CD security with StepSecurity

Recidiviz secures 46% of U.S. prison population workflows with StepSecurity

Recidiviz, a technology non-profit, faced significant security challenges after transitioning to self-hosted GitHub Actions runners for their CI/CD pipelines. Their primary concerns included securing access to cloud infrastructure, preventing secret exfiltration, and a complete lack of network monitoring for potential threats. The team needed a purpose-built solution to implement network-level security and enforce least privilege access without hindering developer productivity or undertaking a complex DIY project.

StepSecurity addressed this by implementing its Harden-Runner solution, which provided real-time network monitoring and automated policy enforcement. The deployment was streamlined through automated pull requests that quickly instrumented all workflows across the organization. As a result, Recidiviz gained full visibility into CI/CD pipeline activity, established a secure baseline, and safely deprecated risky third-party actions. StepSecurity delivered these robust security improvements with no performance impact, saving considerable engineering effort and providing peace of mind against supply chain threats.

Recidiviz