Shift-left

Draw the software lifecycle from left to right: code, build, test, staging, production. Shift-left means moving security checks as far to the left of that line as possible, from production toward the developer's keyboard.

The most tangible example is pre-commit: a local hook that runs the same tools as the pipeline, but on the dev's machine, before the code even leaves. The configuration below runs secrets scanning and SAST on every commit:

The local hook is fast and cheap, but it is not an authority: you can pass --no-verify and skip it. That is why the same check runs again on the PR and in the build, layers with different costs. Early (IDE, pre-commit) for fast feedback; later (CI) as the real gate that nobody skips.

The cost of a defect grows by orders of magnitude as it moves through the lifecycle: fixing a line in the editor takes seconds; the same problem in production can cost an incident, a leak and users' trust. Shift-left is not about liking security, it is about arithmetic.

Moving checks earlier does not eliminate what comes later: some vulnerabilities only exist in the assembled system, with real configuration and data, which is the territory of DAST and production monitoring. Shift-left complements late checks, it does not replace them.