Shift-Left Security Without Slowing Down Developers

# GitHub Actions: Fast security checks in PR pipeline
security-fast:
  runs-on: ubuntu-latest
  timeout-minutes: 5        # Hard limit: 5 minutes
  steps:
    - uses: actions/checkout@v4

    # Secret detection (< 30 seconds)
    - name: Detect secrets
      uses: trufflesecurity/trufflehog@main
      with:
        extra_args: --only-verified

    # Dependency vulnerability check (< 60 seconds)
    - name: Check dependencies
      run: trivy fs --scanners vuln --severity CRITICAL,HIGH .

    # IaC misconfiguration (< 60 seconds)
    - name: Check IaC
      run: checkov -d . --quiet --compact --skip-check LOW

# Deep scan runs async, doesn't block PRs
security-deep:
  runs-on: ubuntu-latest
  if: github.event_name == 'push' && github.ref == 'refs/heads/main'
  steps:
    - name: Full SAST scan
      run: semgrep scan --config auto --severity ERROR WARNING

    - name: Container scan
      run: trivy image --severity CRITICAL,HIGH $IMAGE

    - name: DAST scan
      run: zap-baseline.py -t $STAGING_URL

# What should BLOCK a PR:
block_on:
  - severity: CRITICAL
    exploitable: true
  - type: hardcoded_secret
    verified: true
  - type: sql_injection
  - type: command_injection

# What should WARN (comment on PR, don't block):
warn_on:
  - severity: HIGH
  - type: dependency_vulnerability
    fix_available: true

# What should be LOGGED (async report only):
log_only:
  - severity: MEDIUM
  - severity: LOW
  - type: informational

❌ BLOCKED: 1 critical finding

SQL Injection in user input handling
  → src/api/users.ts:42 (and 2 similar locations)
  → Fix: Use parameterized queries
  → Docs: https://wiki.internal/security/sql-injection

⚠️ WARNING: 3 findings (non-blocking)
  → 2 HIGH severity dependency vulnerabilities (fix available)
  → 1 HIGH severity misconfiguration in Terraform

Finding: SQL Injection vulnerability
File: src/api/users.ts:42

Current code:
  const query = `SELECT * FROM users WHERE id = ${userId}`;

Suggested fix:
  const query = 'SELECT * FROM users WHERE id = $1';
  const result = await db.query(query, [userId]);

[Apply Fix] [Dismiss] [Mark as False Positive]

# Automated dependency update workflow
- name: Auto-fix vulnerable dependencies
  if: vulnerability.fix_available == true
  steps:
    - run: npm audit fix
    - run: |
        git checkout -b security/fix-${{ vulnerability.id }}
        git commit -am "fix: update ${{ vulnerability.package }} to ${{ vulnerability.fixed_version }}"
        gh pr create --title "Security: Fix ${{ vulnerability.id }}" \
          --body "Automated fix for ${{ vulnerability.title }}"

# OPA policy: Enforce secure defaults
package kubernetes.admission

# ALLOW: Images from approved registries
allow {
  input.request.object.spec.containers[_].image
  startswith(input.request.object.spec.containers[_].image, "ghcr.io/our-org/")
}

# DENY: Containers running as root
deny[msg] {
  container := input.request.object.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := sprintf("Container %s must set runAsNonRoot: true", [container.name])
}