Shift Left Security

Shift Left Security advocates moving security checks and protective actions earlier from the post-launch operations stage to earlier stages such as requirements, design, coding, and the CI/CD pipeline; the later a defect is found, the higher the cost of fixing it.

Shift-left security is a philosophy of introducing security practices as early as possible in the software development lifecycle, advocating moving activities such as security requirements, threat modeling and code scanning forward to the requirements analysis, design and coding stages.

Shifting security left means moving security detection from the post-release operations stage earlier to early development stages such as coding, committing, and building; the earlier a problem is found, the lower the cost of fixing it.

The cost of fixing vulnerabilities grows exponentially as development progresses, with the cost of detection and remediation during the coding phase being far lower than during the testing phase or in production.

Red team testing and the principle of least privilege together form the core of the Shift Left philosophy, which embeds security constraints into system architecture at the design and deployment stages.

Container security should proactively reduce the attack surface during the image build stage, rather than relying solely on post-deployment scanning and patching.

安全左移（Shift Left Security）是DevSecOps运动的核心理念，Netflix、Google等已在传统软件开发中广泛采纳