Secure Software Development Lifecycle

Building security checks into every phase of development instead of testing for it only at the end.

What it is

Secure SDLC integrates security activities into every phase of the development lifecycle — design, coding, testing, and deployment — rather than treating security as a final gate before release.

Key points

Shift left: catching a vulnerability at design or code-review time is far cheaper than catching it in production.
Static analysis (SAST) scans source code for known vulnerability patterns; dynamic analysis (DAST) tests the running application; both are typically automated in CI.
Dependency scanning: most real-world vulnerabilities in modern applications come from third-party dependencies, not first-party code — tracking and patching these is a core SDLC activity.
Security requirements and threat modeling belong at the design phase, before a line of code is written — this is what "secure by design" means in practice.