Security Testing as a First-Class SDLC Citizen

Functional testing has traditionally been the primary quality gate in the software development life cycle (SDLC). With the steady rise in cyberattacks, however, security testing has moved from an afterthought to a core track running alongside the entire development process. A software security assessment actively scans for weaknesses before bad actors can exploit them — and it applies at every stage, including design, development, deployment, and maintenance.

At Spotify, the application security program treats this as a layered effort built around several scanning tools that identify and report vulnerabilities. These are referred to as reactive controls. The vulnerability management platform tracks the lifecycle of each finding, giving asset owners and operations teams a clear path to remediation and risk management per internal policy. Automation is central to keeping software, assets, and components current and healthy, which in turn provides another layer of defense.

Supply chain security is a particular focus. Spotify consumes large quantities of external software — libraries, services, applications, and infrastructure — each of which could be a vector for an attack. The secure supply chain initiative exists to make sure both the software Spotify brings in and the software it delivers to customers can be trusted. The goal is to prevent attacks aimed at any phase of the SDLC.

Tooling for a Diverse, Fast-Moving Environment

Two requirements shaped Spotify’s approach to security testing tooling:

  • Covering the organization’s wide variety of languages and package managers.
  • Providing a solution flexible enough to plug into the existing CI/CD infrastructure.

The team chose Snyk, which already supported nearly every language and package manager Spotify wanted to use, with plans for further expansion in areas of interest. Integration was done directly into the build pipeline so review builds could be scanned for vulnerabilities. The rollout happened in stages, prioritizing perimeter services and those handling sensitive data.

Developer Experience by Design

With thousands of engineers at the company, Spotify was deliberate about implementing security testing automation without burdening developers. For many languages and frameworks, vulnerability scanning is now embedded in the CI/CD pipeline automatically. Adoption in those cases required no action from engineers at all. For languages not covered by this automatic process, developers follow a simple guide to enable Snyk scans as a build step for their application. The result has been a steady increase in the number of scanned projects across the organization.

Looking Ahead: Toward Self-Service Security

As attack vectors evolve as quickly as the software industry itself, a holistic approach to secure development is essential. Future efforts at Spotify include automatically generating fixes and merging them without manual intervention from engineering or security teams. The team is also leveraging Snyk’s APIs to track vulnerability lifecycles and integrate that data into the internal vulnerability management platform. Additional paths forward include source code analysis, fleet-wide upgrades driven by automation, and proactive supply chain management that concentrates on security at every phase of the development cycle.

The underlying principle within Spotify’s Security team is taking risks responsibly — scaling safely rather than simply scaling quickly.