Browse
Secure Software Development Lifecycle
Building security checks into every phase of development instead of testing for it only at the end.
What it is
Secure SDLC integrates security activities into every phase of the development lifecycle — design, coding, testing, and deployment — rather than treating security as a final gate before release.
Key points
- Shift left: catching a vulnerability at design or code-review time is far cheaper than catching it in production.
- Static analysis (SAST) scans source code for known vulnerability patterns; dynamic analysis (DAST) tests the running application; both are typically automated in CI.
- Dependency scanning: most real-world vulnerabilities in modern applications come from third-party dependencies, not first-party code — tracking and patching these is a core SDLC activity.
- Security requirements and threat modeling belong at the design phase, before a line of code is written — this is what "secure by design" means in practice.