Shift-Left Security: Building Security into Every Stage of Development

Cost Multiplier by SDLC Phase (IBM System Science Institute):

Example Pre-Commit Hook Configuration (.pre-commit-config.yaml):

repos:
  # Secrets Detection
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

  # Security Linting
  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.5
    hooks:
      - id: bandit
        args: ['-ll', '-i']  # Only high severity

  # Dependency Scanning  
  - repo: https://github.com/safety-cli/safety
    rev: 2.3.5
    hooks:
      - id: safety
        args: ['--json']

  # Infrastructure as Code
  - repo: https://github.com/bridgecrewio/checkov
    rev: 2.5.0
    hooks:
      - id: checkov
        args: ['--quiet', '--framework', 'terraform']

name: Security Checks
on: [pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # SAST with Semgrep
      - name: Run Semgrep
        run: |
          python -m pip install semgrep
          semgrep --config=auto --error --severity ERROR
          
      # Dependency Scanning
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high
          
      # Secrets Detection
      - name: GitLeaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          
      # Container Scan (if Dockerfile changed)
      - name: Build and Scan Image
        if: contains(github.event.pull_request.changed_files, 'Dockerfile')
        run: |
          docker build -t app:pr-${{ github.event.number }} .
          docker run aquasec/trivy image --severity HIGH,CRITICAL app:pr-${{ github.event.number }}

      # Post results as PR comment
      - name: Comment PR
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '✅ Security checks passed!'
            })

OPA (Open Policy Agent) Example - Kubernetes Pod Security:

package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  not input.request.object.spec.securityContext.runAsNonRoot
  msg := "Containers must not run as root"
}

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  not container.securityContext.readOnlyRootFilesystem
  msg := sprintf("Container %v must use read-only root filesystem", [container.name])
}

deny[msg] {
  input.request.kind.kind == "Pod"
  container := input.request.object.spec.containers[_]
  container.securityContext.privileged
  msg := sprintf("Container %v must not run in privileged mode", [container.name])
}