Security scanning on the team ran late or not at all. SAST fired generic rules that developers learned to ignore. Container images reached production without a vulnerability pass. Secrets had appeared in git history more than once. The choice seemed to be slow every merge with noisy findings, or skip checks and hope review caught problems. Neither option scaled.

I wired checks into pull requests where developers already work. Semgrep rules were tuned to our stack so findings came with fix context instead of boilerplate severity. Critical issues block merge. Warnings open tickets automatically. Trivy scans images and lockfiles before deploy. Gitleaks searches history, not just the latest diff. Failed scans post results in the PR thread with reproduction steps so the author does not hunt through CI logs.

Every merge request runs SAST, container scanning, and secret detection as standard pipeline stages. Developers see security feedback beside code review. Supply chain checks gate deploy artifacts. The pipeline distinguishes between stop-ship findings and work that can ship with a tracked follow-up.