The Hidden Threat in Your Software Development Lifecycle: Why Self-Hosted Runners Need Zero Trust
Zscaler, Tuesday, August 11th, 2026
Zscaler argues self-hosted GitHub Actions runners create a privileged outbound risk that firewalls do not address.
Zscaler examines self-hosted GitHub Actions runners as an under-recognised attack surface in the software delivery pipeline.
It cites Sonatype's State of the Software Supply Chain 2026 report, which tracked more than 454,600 new malicious packages introduced into open-source registries in a single year, a 75% year-over-year surge.
Enterprises prefer self-hosted runners to gain speed, customise build environments and reach resources inside private environments, believing this reclaims control because code stays within their perimeter.