PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shift Left is Dead: A Post Mortem

hackerone.com | blog | #appsec | #devsecops | #security-culture | #security-strategy | #false-positives | #application-security | #shift-left | #developer-experience
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne's CTO argues shift left failed: tools disrupt workflows, flood developers with false positives, and lack actionable alerts; he calls for a developer-first security approach instead.
Published
Collected

Related coverage

blog · projectdiscovery.io
Continuous PR Security Review
Post-mortem vulnerabilities often look harmless in the diff—they only surface at runtime. ProjectDiscovery says LLM code review hits just 63% precision, so PRs need validation on a running app.
blog · hackerone.com
Resurrecting Shift-Left With Human-in-the-loop AI
HackerOne's founders argue shift-left security fails when controls are noisy and blocking; they propose human-in-the-loop AI that delivers low-noise, actionable, non-blocking feedback in development.
blog · wiz.io
What Security Should Look Like When Built for Developers
First of a four-part series on developer-centric security: Wiz critiques legacy AppSec scanners and outlines principles for tools that fit developers' real workflows — from IDE to pull requests.
blog · wiz.io
Cupid in the cloud: celebrating developer and security team partnerships
A Valentine's feature on developer and security team partnerships, profiling how AppsFlyer and other teams moved from silos to shift-left collaboration with shared goals and smoother remediation.
blog · netspi.com
Build Strong Relationships Between Development and Application Security Teams to Find and Fix Vulnerabilities Faster
Bridging the DevSecOps divide: with 71% of AppSec pros citing developers who skip early security work, the post urges empathy and shared incentives between development and security teams.
blog · netspi.com
Shifting Left to Move Forward: Five Steps for Building an Effective Secure Code Review Program
Five steps for an effective secure code review program: build security culture with developers, rotate reviewers, standardize processes and tooling, and catch vulnerabilities before deployment.
Back