Shift Left
Move security earlier — validation and review in YOUR repo before deploy, not after stranger breach.
Visual · shift_left
Shift-left literacy. $MY_REPO only. Original Cyberlium.
Shift left means cheaper fixes in design — not earlier sqlmap on someone else's shop.
'Shift left' pushes security activities earlier: threat modeling in design, secure coding standards in implementation, unit tests for validation, dependency scanning in CI — all on $MY_REPO before any public deploy. Fixing injection in a design doc beats emergency patch Saturday night on production you do not own. Cyberlium teaches shift-left habits locally: pre-commit hooks, linter rules, and review checklists on your toy app. You will NOT 'shift left' by fuzzing classmate APIs or running ZAP against live e-commerce. Next: SDLC Lab.
1. Earlier checkpoints, smaller bills
Requirements: abuse cases. Design: trust boundaries. Code: validate and parameterize. CI: SAST and dependency audit on $MY_REPO. Each leftward move catches bugs when diff is small.
Defenders prefer prevention evidence in tickets — you practice writing 'validate email allowlist in PR' before merge.
Command guide
Try these commands — Earlier checkpoints, smaller bills
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: python3, curl. Reference sites: Shift left (https://owasp.org/www-project-developer-guide/); SAST early (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Shift left is not shift blame
Developers, QA, and security share the pipeline. Shift left adds tools and habits — not permission to attack staging URLs you do not own.
Running offensive scans on stranger SaaS 'early' is still out of scope. Left means your keyboard on your repo.
3. Lab habits you can ship today
Pick one shift-left action for $MY_REPO: add input validation unit test, enable dependency audit script, or document review checklist in README.
Ship: one shift-left action committed or noted. Next: SDLC Lab.
4. What you ship: one shift-left action for $MY_REPO
Name one early security checkpoint added (test, lint, checklist). Local repo only. chmod 600 note.
5. What you record before the next lesson
Date. Shift-left action description. $MY_REPO branch if used. File t17-m02-l03-shift-left.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run ZAP on live shop because 'test early.' Skip design and paste exploit code into classmate repo.
- Right: Document one shift-left action on $MY_REPO. Next: SDLC Lab.
Mission: one shift-left checkpoint
1) Pick validate-in-PR, dependency audit, or review checklist. 2) Implement or document on $MY_REPO. 3) No stranger URL scanning. Never confuse shift left with early offense on others.
Stuck? Ask Cyberlium AI Mentor
A single validation unit test is valid shift left — no scanner required.
APPLY: Shift left primarily means:
APPLY: True or False: Fuzzing a classmate's API 'early in the sprint' is shift left.
APPLY: A shift-left win on $MY_REPO might be: