Shift-left security
Shift-left security means moving security work earlier in the software lifecycle. If you draw the lifecycle as a timeline from design on the left to production on the right, you push checks toward the left: into design reviews, the editor, commits and pull requests. Problems are found while a change is still small and the author still remembers it.
How it works
Consider one change, the day a developer adds a library.
In the editor or a pre-commit hook, a secret scanner blocks a pasted cloud key before it reaches Git.
On the pull request, a dependency scan flags a library with a known critical vulnerability. The fix is a one-line version bump.
In design, a short threat model asks who can call the new endpoint.
The same flaw found in production needs a hotfix, a rollback and possibly key rotation.
Why it matters in production
Early findings are cheaper to fix and do not block a release. Shifting left does not replace later checks. You still need runtime monitoring and periodic testing, and you must keep alerts few and relevant, or developers carry extra load and learn to ignore them.
See also
On the One2N blog
Further reading
