Security Week: Closing the Gap Between Development and Defense

GitHub InFocus, the virtual series for software teams, continues this week with a focus on security. Following sessions on DevOps fundamentals, the program turns to application security, DevSecOps, and code security—three related disciplines that address where modern vulnerabilities actually live.

Application security is the practice of using tools, processes, and best practices to manage business risk tied to software. DevSecOps extends the DevOps principle of shared responsibility to security: everyone involved in the development lifecycle owns the security of what they build. Code security targets the code itself, whether it is open source dependencies or custom code written in-house.

The distinction matters because applications have become a primary attack surface. Many high-profile breaches in recent years exploited weaknesses at the application layer, and fixing those problems at the source is far cheaper and more effective than catching them at deployment.

Automation Is the Enabler

Historically, security teams operated as a final gate before release. That model does not scale with modern release velocity. The alternative is to give developers immediate feedback as they write code. GitHub’s secret scanning and code scanning features check code automatically during development, while open source tools like OWASP ZAP can automate testing for applications already in production.

The key is not to dump raw scan results into issue trackers and hope developers act on them. Effective DevSecOps integrates security checks into the workflows developers already use, so findings surface contextually and early.

Securing the Software Supply Chain

Modern codebases are overwhelmingly built on open source components—up to 99 percent of them, by some estimates. That makes the question less about whether you use open source and more about which open source you use. Without visibility into your dependencies, an upstream vulnerability can ripple into your applications unnoticed.

Roughly 85 percent of open source vulnerabilities are disclosed with a patch already available, but remediation is not just about patching. Teams need to track what dependencies they pull in, audit them regularly, remove ones that are no longer necessary, and monitor the supply chain continuously. Shifting security reviews earlier in the development process means vulnerabilities get fixed before they reach production.

Avoiding the Classic Pitfalls

The most common mistake is treating security as an afterthought. In most organizations, developers vastly outnumber security specialists, so a model where security reviews happen late is guaranteed to miss issues. Code moves too fast and in too high a volume for manual, end-of-cycle checks to keep up. Vulnerabilities slip through and end up in production.

There is no canonical checklist for teams just starting out. DevSecOps is a mindset shift more than a set of practices. The change that matters most is applying security earlier in the development lifecycle—partnering security teams with developers in the environments where the developers already work.

The Developer-First Argument

Security teams will never be large enough to keep pace with the volume of issues an organization generates. That reality makes application security a joint responsibility. Developers are the ones who will fix the vulnerabilities their tools identify, so those tools need to fit into their existing workflows.

The closing advice from the session hosts boils down to three points:

  • If you already practice DevOps, DevSecOps is the natural extension—you are applying the same collaborative principles to security instead of keeping it separate.
  • Security is an ongoing part of development, not a final checkpoint. Know what is in your environment, manage your dependencies, and monitor the supply chain.
  • Put developers at the center. They are the ones who resolve the findings.

Security Week at GitHub InFocus runs starting March 9 at 11am PT / 2pm ET, with sessions covering automation in DevSecOps, supply chain threats, and real-world examples from organizations like Eli Lilly and Thermo Fisher.