Security /

AppSec

Before code

What data is involved and who should be able to touch it?
Where are the trust boundaries and privileged actions?
What dependencies or outside services are we bringing in?

While building

Code review, SAST, secret scanning, dependency checks, and tests catch different things.
No single scanner covers AppSec; layer them.

Authorization

Being logged in does not mean you should be able to reach every object or action.
Authorization should be checked at the point the action happens, not just at the front door.

Supply chain

Dependencies and registries.
CI identities and build permissions.
Artifacts and the path from source to deployment.