Secure › Module 2 › Lesson 3
Shift Left
Move security earlier — validation and review in YOUR repo before deploy, not after stranger breach.
Visual · shift_left
Shift-left literacy. $MY_REPO only. Original Cyberlium.
Opening
Shift left means cheaper fixes in design — not earlier sqlmap on someone else's shop.
'Shift left' pushes security activities earlier: threat modeling in design, secure coding standards in implementation, unit tests for validation, dependency scanning in CI — all on $MY_REPO before any public deploy. Fixing injection in a design doc beats emergency patch Saturday night on production you do not own. Cyberlium teaches shift-left habits locally: pre-commit hooks, linter rules, and review checklists on your toy app. You will NOT 'shift left' by fuzzing classmate APIs or running ZAP against live e-commerce. Next: SDLC Lab.
1. Earlier checkpoints, smaller bills
Requirements: abuse cases. Design: trust boundaries. Code: validate and parameterize. CI: SAST and dependency audit on $MY_REPO. Each leftward move catches bugs when diff is small.
Defenders prefer prevention evidence in tickets — you practice writing 'validate email allowlist in PR' before merge.
Command guide
Try these commands — Earlier checkpoints, smaller bills
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Shift left — https://owasp.org/www-project-developer-guide/ SAST early — https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Shift left: fix in PR before prod incident')"
curl -sS https://csrc.nist.gov/publications/detail/sp/800-218/final | head -5Primary tools to practice this lesson: python3, curl. Reference sites: Shift left (https://owasp.org/www-project-developer-guide/); SAST early (https://cheatsheetseries.owasp.org/cheatsheets/Source_Code_Analysis_Tools_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Shift left is not shift blame
Developers, QA, and security share the pipeline. Shift left adds tools and habits — not permission to attack staging URLs you do not own.
Running offensive scans on stranger SaaS 'early' is still out of scope. Left means your keyboard on your repo.
3. Lab habits you can ship today
Pick one shift-left action for $MY_REPO: add input validation unit test, enable dependency audit script, or document review checklist in README.
Ship: one shift-left action committed or noted. Next: SDLC Lab.
4. What you ship: one shift-left action for $MY_REPO
Name one early security checkpoint added (test, lint, checklist). Local repo only. chmod 600 note.
5. What you record before the next lesson
Date. Shift-left action description. $MY_REPO branch if used. File t17-m02-l03-shift-left.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run ZAP on live shop because 'test early.' Skip design and paste exploit code into classmate repo.
Right
Document one shift-left action on $MY_REPO. Next: SDLC Lab.
Mission: one shift-left checkpoint
1) Pick validate-in-PR, dependency audit, or review checklist. 2) Implement or document on $MY_REPO. 3) No stranger URL scanning. Never confuse shift left with early offense on others.
Stuck? Ask Cyberlium AI Mentor
A single validation unit test is valid shift left — no scanner required.
Knowledge Check
APPLY: Shift left primarily means:
Multiple choice
Knowledge Check
APPLY: True or False: Fuzzing a classmate's API 'early in the sprint' is shift left.
True or False
Knowledge Check
APPLY: A shift-left win on $MY_REPO might be:
Multiple choice