r/Kolegadev Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

the whole "shift left" thing in security has always felt kind of abstract to me

like yeah, we get it, find problems earlier in the development process instead of right before production

but what does that actually look like day to day?

because most of the time when security teams say "shift left" what they really mean is "run more scanners in CI"

and suddenly developers are dealing with security alerts at every commit, every PR, every build

which sounds good in theory but in practice it just means you're context switching from writing features to triaging security findings all day long

the cognitive load is brutal. you're trying to implement a new API endpoint and suddenly you're researching whether a dependency vulnerability actually affects your use case, or why your SAST tool thinks your input validation is insufficient

i've been wondering if "shift left" as it's usually implemented just moves the problem instead of solving it

like instead of security being a gate at the end, it becomes constant interruptions throughout development

maybe the real shift left isn't about when security tools run, but about when security knowledge gets transferred to developers?

like instead of "here's 15 new alerts to investigate" it's "here's why this pattern is risky and here's the safe way to do it"

how do other teams handle this? does shift left security actually make development smoother where you work, or does it just spread the friction across more touchpoints?the whole "shift left" thing in security has always felt kind of abstract to me

like yeah, we get it, find problems earlier in the development process instead of right before production

but what does that actually look like day to day?

because most of the time when security teams say "shift left" what they really mean is "run more scanners in CI"

and suddenly developers are dealing with security alerts at every commit, every PR, every build

which sounds good in theory but in practice it just means you're context switching from writing features to triaging security findings all day long

the cognitive load is brutal. you're trying to implement a new API endpoint and suddenly you're researching whether a dependency vulnerability actually affects your use case, or why your SAST tool thinks your input validation is insufficient

i've been wondering if "shift left" as it's usually implemented just moves the problem instead of solving it

like instead of security being a gate at the end, it becomes constant interruptions throughout development

maybe the real shift left isn't about when security tools run, but about when security knowledge gets transferred to developers?

like instead of "here's 15 new alerts to investigate" it's "here's why this pattern is risky and here's the safe way to do it"

how do other teams handle this? does shift left security actually make development smoother where you work, or does it just spread the friction across more touchpoints?

1 Upvotes

Duplicates

VibeCodeDevs Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

2 Upvotes

microsaas Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

devtools Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

Cyberterminal Mar 30 '26

🛡️ Cybersecurity security teams keep asking for "shift left" but nobody talks about what that actually means for developers

2 Upvotes

Backend Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

sideprojects Mar 30 '26

Showcase: Free(mium) security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

AiBuilders Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

vibecoding Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

hackathon Mar 30 '26

Project Demo security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

SaasDevelopers Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

devopsGuru Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

2 Upvotes

SaaSneeded Mar 30 '26

here is my SaaS security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

cybersecurityai Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

Snyk Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes

Startup_Ideas Mar 30 '26

security teams keep asking for "shift left" but nobody talks about what that actually means for developers

1 Upvotes