the whole "shift left" thing in security has always felt kind of abstract to me

like yeah, we get it, find problems earlier in the development process instead of right before production

but what does that actually look like day to day?

because most of the time when security teams say "shift left" what they really mean is "run more scanners in CI"

and suddenly developers are dealing with security alerts at every commit, every PR, every build

which sounds good in theory but in practice it just means you're context switching from writing features to triaging security findings all day long

the cognitive load is brutal. you're trying to implement a new API endpoint and suddenly you're researching whether a dependency vulnerability actually affects your use case, or why your SAST tool thinks your input validation is insufficient

i've been wondering if "shift left" as it's usually implemented just moves the problem instead of solving it

like instead of security being a gate at the end, it becomes constant interruptions throughout development

maybe the real shift left isn't about when security tools run, but about when security knowledge gets transferred to developers?

like instead of "here's 15 new alerts to investigate" it's "here's why this pattern is risky and here's the safe way to do it"

how do other teams handle this? does shift left security actually make development smoother where you work, or does it just spread the friction across more touchpoints?the whole "shift left" thing in security has always felt kind of abstract to me

like yeah, we get it, find problems earlier in the development process instead of right before production

but what does that actually look like day to day?

because most of the time when security teams say "shift left" what they really mean is "run more scanners in CI"

and suddenly developers are dealing with security alerts at every commit, every PR, every build

which sounds good in theory but in practice it just means you're context switching from writing features to triaging security findings all day long

the cognitive load is brutal. you're trying to implement a new API endpoint and suddenly you're researching whether a dependency vulnerability actually affects your use case, or why your SAST tool thinks your input validation is insufficient

i've been wondering if "shift left" as it's usually implemented just moves the problem instead of solving it

like instead of security being a gate at the end, it becomes constant interruptions throughout development

maybe the real shift left isn't about when security tools run, but about when security knowledge gets transferred to developers?

like instead of "here's 15 new alerts to investigate" it's "here's why this pattern is risky and here's the safe way to do it"

how do other teams handle this? does shift left security actually make development smoother where you work, or does it just spread the friction across more touchpoints?