Shift-Left Security

"Shift left" means moving a concern earlier in the timeline - toward the "left" end of a plan-build-test-release diagram. Applied to security, it means catching problems while code is still in review, not after it's already running in production.

Why earlier is cheaper

A vulnerability found in code review costs a few minutes to fix. The same vulnerability found by a customer, or an attacker, after release costs an incident, a scramble, and often a public disclosure. The cost of the exact same bug grows by orders of magnitude the later it's caught - the single biggest argument for building these checks straight into the pipeline from this curriculum's CI/CD lessons.

SAST: static analysis

Static Application Security Testing scans your source code directly, without running it, looking for known-dangerous patterns - string-concatenated SQL queries, hardcoded secrets, unsafe deserialization. It runs in seconds as part of a pipeline stage, on every single commit.

DAST: dynamic analysis

Dynamic Application Security Testing instead tests the running application from the outside - sending it malformed input, probing its actual HTTP responses - the way an external attacker actually would. It catches a different class of issue than SAST (real runtime behavior, not just suspicious-looking code).

Dependency and image scanning

Modern software is mostly other people's code: third-party libraries, base container images. A dependency scanner checks every library your project pulls in against a database of known vulnerabilities; an image scanner does the same for a built container image's full set of installed packages - both a natural pipeline stage right after the build step from the Docker lessons earlier in this curriculum.

Try it

docker images

When you're ready, hit Mark complete and move to the next lesson.