Four recent supply chain attack campaigns (GhostAction, Megalodon, Miasma, Hades) share a common cash-out step: after stealing a developer's GitHub token, attackers commit malicious workflow files that use toJSON(secrets) to dump all repository secrets and exfiltrate them as artifacts. Existing controls like branch protection and code review miss this because attacks run from throwaway branches without opening pull requests. StepSecurity introduces two defensive layers: a Secret Exfiltration Policy that blocks unreviewed workflows from accessing secrets, and a Harden-Runner detection that identifies exfiltration attempts by matching workflow names, secret-dump patterns, commit messages, and artifact names. Together these provide enforcement and visibility against this attack pattern.
