Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-5

CI/CD & GitHub Hardening

Lock down your GitHub org and pipelines.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Starter

$750

Hours. 6 hours

Scope. 1 org, ≤10 repos, ≤15 workflows

Deliverables

  • Findings
  • pinned-SHA action list
  • branch-rule settings

Turnaround. 4 business days

Pay deposit ($375) (opens Stripe in a new tab) Pay final balance ($375) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Standard

$1,500

Hours. 12 hours

Scope. 1 org, ≤40 repos, ≤60 workflows

Deliverables

  • Starter items
  • OIDC/secret scoping plan
  • Dependabot/Renovate config

Turnaround. 6 business days

Pay deposit ($750) (opens Stripe in a new tab) Pay final balance ($750) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$2,800

Hours. 22 hours

Scope. ≤2 orgs, ≤100 repos, reusable workflows

Deliverables

  • Standard items
  • rulesets rollout plan
  • runner hardening notes

Turnaround. 10 business days

Pay deposit ($1,400) (opens Stripe in a new tab) Pay final balance ($1,400) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

OpenSSF Scorecard checks; NIST SSDF PO.3 / PS.1; OWASP Top 10:2025 A03 Supply Chain; NIST CSF 2.0 GV.SC / PR.PS.

Exclusions

  • Admin changes unless the client grants a scoped admin role in writing
  • self-hosted runner host hardening beyond config

Acceptance

Every third-party action is listed with current ref and recommended pinned SHA; Scorecard before/after score recorded when fixes are applied.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services