Shift-Left Security Communication Vocabulary
Practice shift-left security vocabulary: moving security earlier in the SDLC, security champion programmes, developer security training, security by design, and threat modeling in sprints.
0 / 26 completed
1 / 26
What does 'shift left security' mean?
Shift-left security means moving security activities from the end of the SDLC (where fixing issues is expensive) to the beginning — threat modeling in design, SAST in CI, and security training for developers. Fixing a vulnerability at design costs 100x less than fixing it in production.
2 / 26
What is a 'security champion programme'?
Security champions are developers within product teams who receive additional security training and act as the first line of security advice for their team. The programme scales security expertise without requiring a dedicated security engineer on every team.
3 / 26
'Security by design' means:
Security by design treats security as a foundational architectural requirement, not an add-on. Systems designed with security in mind from day one have fewer vulnerabilities than systems where security was bolted on after the fact.
4 / 26
A team says 'we do ___ modeling as part of sprint planning.' What word fits?
Threat modeling as part of sprint planning means that before implementing a new feature, the team identifies potential threats, attack vectors, and security requirements. This is the practical implementation of shift-left security at the sprint level.
5 / 26
Which statement best describes 'developer security training' in a DevSecOps context?
Effective developer security training is role-specific, continuous, and practical. It covers topics like SQL injection prevention, secure authentication patterns, and how to interpret SAST findings — empowering developers to write secure code from the start.
6 / 26
Sarah: 'Hey team, just flagged a potential vulnerability in the user authentication module. I've added a comment to the PR describing it and suggesting a rate limiting solution. It's critical we address this before deployment.'
Which of the following best describes Sarah's communication approach?Sarah is demonstrating 'shift-left' communication by addressing a potential vulnerability early in the development lifecycle – specifically within the PR discussion. This contrasts with waiting for a formal bug report or simply focusing on technical debt; it's about actively raising security concerns as part of the regular code review process, thus pushing security activities to the 'left' of the traditional waterfall approach. The goal is to prevent issues from escalating later in the deployment pipeline.7 / 26
PR Description:
Subject: Urgent - Potential XSS Vulnerability in User Profile Update Endpoint
Details:
I've identified a potential Cross-Site Scripting (XSS) vulnerability in the user profile update endpoint /api/v1/users/{userId}. Specifically, unsanitized user input is being directly reflected within the HTML response when a user attempts to modify their display name. This could allow an attacker to inject malicious JavaScript code into the browser of other users who view the updated profile. I've added a temporary fix – escaping all user-provided data – but a more robust solution involving proper input validation and output encoding is required.
Note: The API endpoint uses Express.js with Node.js v16 and utilizes a basic templating engine.The correct answer emphasizes concise communication focused on actionable steps. While documenting technical details is important, Sarah's goal here is to immediately alert the team to the problem and what needs to be done. Options A and B are too verbose for a PR description; they would overwhelm the reader with unnecessary information. Option D is outside the scope of a PR description – this is an urgent issue requiring immediate developer attention.
8 / 26
Alex posted this comment on a PR before merging:
"Just noticed potential SQL injection vulnerability in the `get_user` function. Using string concatenation to build the query – should definitely sanitize input."
Which of the following best describes Alex's communication and its implications for a shift-left security approach?The correct answer highlights Alex's key action: identifying a vulnerability (SQL injection) and proposing remediation – this directly aligns with 'shift-left'. The other options misinterpret the comment's value. Option A is partially true but misses the critical point of proactive communication. Options B and C are too extreme, suggesting immediate escalation or simply stating it needs more detail without acknowledging the identified risk. Option D correctly identifies a weakness in the proposed solution – manual sanitization isn't scalable – but doesn't accurately reflect Alex's initial contribution to the security discussion.
9 / 26
Sarah's communication regarding the potential XSS vulnerability demonstrates a key principle of shift-left security. Her proactive reporting via a detailed PR description, coupled with proposed remediation steps (escaping input and suggesting robust validation), highlights the importance of identifying and addressing vulnerabilities early in the development lifecycle – ideally *before* deployment. This contrasts with waiting for a security team to find the issue after code is already live. Consider Sarah's approach in the context of a typical PR description.
The correct answer emphasizes Sarah's proactive approach – identifying the vulnerability in a PR description and suggesting solutions. This aligns with 'shift-left' which advocates for embedding security practices within development processes *before* deployment. Options A and B misrepresent her actions as reactive or solely symptom-focused, while option D is entirely inaccurate; option C correctly reflects the core principle of early vulnerability identification.
10 / 26
Sarah: 'Hey team, just flagged a potential vulnerability in the user authentication module. I've added a comment to the PR describing it and suggesting a rate limiting solution. It's critical we address this before deployment.'
Which of the following best describes Sarah's communication approach?Sarah is demonstrating 'shift-left' communication by addressing a potential vulnerability early in the development lifecycle – specifically within the PR discussion. This contrasts with waiting for a formal bug report or simply focusing on technical debt; it's about actively raising security concerns as part of the regular code review process, thus pushing security activities to the 'left' of the traditional waterfall approach. The goal is to prevent issues from escalating later in the deployment pipeline.11 / 26
PR Description:
Subject: Urgent - Potential XSS Vulnerability in User Profile Update Endpoint
Details:
I've identified a potential Cross-Site Scripting (XSS) vulnerability in the user profile update endpoint /api/v1/users/{userId}. Specifically, unsanitized user input is being directly reflected within the HTML response when a user attempts to modify their display name. This could allow an attacker to inject malicious JavaScript code into the browser of other users who view the updated profile. I've added a temporary fix – escaping all user-provided data – but a more robust solution involving proper input validation and output encoding is required.
Note: The API endpoint uses Express.js with Node.js v16 and utilizes a basic templating engine.The correct answer emphasizes concise communication focused on actionable steps. While documenting technical details is important, Sarah's goal here is to immediately alert the team to the problem and what needs to be done. Options A and B are too verbose for a PR description; they would overwhelm the reader with unnecessary information. Option D is outside the scope of a PR description – this is an urgent issue requiring immediate developer attention.
12 / 26
Alex posted this comment on a PR before merging:
"Just noticed potential SQL injection vulnerability in the `get_user` function. Using string concatenation to build the query – should definitely sanitize input."
Which of the following best describes Alex's communication and its implications for a shift-left security approach?The correct answer highlights Alex's key action: identifying a vulnerability (SQL injection) and proposing remediation – this directly aligns with 'shift-left'. The other options misinterpret the comment's value. Option A is partially true but misses the critical point of proactive communication. Options B and C are too extreme, suggesting immediate escalation or simply stating it needs more detail without acknowledging the identified risk. Option D correctly identifies a weakness in the proposed solution – manual sanitization isn't scalable – but doesn't accurately reflect Alex's initial contribution to the security discussion.
13 / 26
Sarah's communication regarding the potential XSS vulnerability demonstrates a key principle of shift-left security. Her proactive reporting via a detailed PR description, coupled with proposed remediation steps (escaping input and suggesting robust validation), highlights the importance of identifying and addressing vulnerabilities early in the development lifecycle – ideally *before* deployment. This contrasts with waiting for a security team to find the issue after code is already live. Consider Sarah's approach in the context of a typical PR description.
The correct answer emphasizes Sarah's proactive approach – identifying the vulnerability in a PR description and suggesting solutions. This aligns with 'shift-left' which advocates for embedding security practices within development processes *before* deployment. Options A and B misrepresent her actions as reactive or solely symptom-focused, while option D is entirely inaccurate; option C correctly reflects the core principle of early vulnerability identification.
14 / 26
Sarah: 'Hey team, just flagged a potential vulnerability in the user authentication module. I've added a comment to the PR describing it and suggesting a rate limiting solution. It's critical we address this before deployment.'
Which of the following best describes Sarah's communication approach?Sarah is demonstrating 'shift-left' communication by addressing a potential vulnerability early in the development lifecycle – specifically within the PR discussion. This contrasts with waiting for a formal bug report or simply focusing on technical debt; it's about actively raising security concerns as part of the regular code review process, thus pushing security activities to the 'left' of the traditional waterfall approach. The goal is to prevent issues from escalating later in the deployment pipeline.15 / 26
PR Description:
Subject: Urgent - Potential XSS Vulnerability in User Profile Update Endpoint
Details:
I've identified a potential Cross-Site Scripting (XSS) vulnerability in the user profile update endpoint /api/v1/users/{userId}. Specifically, unsanitized user input is being directly reflected within the HTML response when a user attempts to modify their display name. This could allow an attacker to inject malicious JavaScript code into the browser of other users who view the updated profile. I've added a temporary fix – escaping all user-provided data – but a more robust solution involving proper input validation and output encoding is required.
Note: The API endpoint uses Express.js with Node.js v16 and utilizes a basic templating engine.The correct answer emphasizes concise communication focused on actionable steps. While documenting technical details is important, Sarah's goal here is to immediately alert the team to the problem and what needs to be done. Options A and B are too verbose for a PR description; they would overwhelm the reader with unnecessary information. Option D is outside the scope of a PR description – this is an urgent issue requiring immediate developer attention.
16 / 26
Alex posted this comment on a PR before merging:
"Just noticed potential SQL injection vulnerability in the `get_user` function. Using string concatenation to build the query – should definitely sanitize input."
Which of the following best describes Alex's communication and its implications for a shift-left security approach?The correct answer highlights Alex's key action: identifying a vulnerability (SQL injection) and proposing remediation – this directly aligns with 'shift-left'. The other options misinterpret the comment's value. Option A is partially true but misses the critical point of proactive communication. Options B and C are too extreme, suggesting immediate escalation or simply stating it needs more detail without acknowledging the identified risk. Option D correctly identifies a weakness in the proposed solution – manual sanitization isn't scalable – but doesn't accurately reflect Alex's initial contribution to the security discussion.
17 / 26
Sarah's communication regarding the potential XSS vulnerability demonstrates a key principle of shift-left security. Her proactive reporting via a detailed PR description, coupled with proposed remediation steps (escaping input and suggesting robust validation), highlights the importance of identifying and addressing vulnerabilities early in the development lifecycle – ideally *before* deployment. This contrasts with waiting for a security team to find the issue after code is already live. Consider Sarah's approach in the context of a typical PR description.
The correct answer emphasizes Sarah's proactive approach – identifying the vulnerability in a PR description and suggesting solutions. This aligns with 'shift-left' which advocates for embedding security practices within development processes *before* deployment. Options A and B misrepresent her actions as reactive or solely symptom-focused, while option D is entirely inaccurate; option C correctly reflects the core principle of early vulnerability identification.
18 / 26
Sarah: 'Hey team, just flagged a potential vulnerability in the user authentication module. I've added a comment to the PR describing it and suggesting a rate limiting solution. It's critical we address this before deployment.'
Which of the following best describes Sarah's communication approach?Sarah is demonstrating 'shift-left' communication by addressing a potential vulnerability early in the development lifecycle – specifically within the PR discussion. This contrasts with waiting for a formal bug report or simply focusing on technical debt; it's about actively raising security concerns as part of the regular code review process, thus pushing security activities to the 'left' of the traditional waterfall approach. The goal is to prevent issues from escalating later in the deployment pipeline.19 / 26
PR Description:
Subject: Urgent - Potential XSS Vulnerability in User Profile Update Endpoint
Details:
I've identified a potential Cross-Site Scripting (XSS) vulnerability in the user profile update endpoint /api/v1/users/{userId}. Specifically, unsanitized user input is being directly reflected within the HTML response when a user attempts to modify their display name. This could allow an attacker to inject malicious JavaScript code into the browser of other users who view the updated profile. I've added a temporary fix – escaping all user-provided data – but a more robust solution involving proper input validation and output encoding is required.
Note: The API endpoint uses Express.js with Node.js v16 and utilizes a basic templating engine.The correct answer emphasizes concise communication focused on actionable steps. While documenting technical details is important, Sarah's goal here is to immediately alert the team to the problem and what needs to be done. Options A and B are too verbose for a PR description; they would overwhelm the reader with unnecessary information. Option D is outside the scope of a PR description – this is an urgent issue requiring immediate developer attention.
20 / 26
Alex posted this comment on a PR before merging:
"Just noticed potential SQL injection vulnerability in the `get_user` function. Using string concatenation to build the query – should definitely sanitize input."
Which of the following best describes Alex's communication and its implications for a shift-left security approach?The correct answer highlights Alex's key action: identifying a vulnerability (SQL injection) and proposing remediation – this directly aligns with 'shift-left'. The other options misinterpret the comment's value. Option A is partially true but misses the critical point of proactive communication. Options B and C are too extreme, suggesting immediate escalation or simply stating it needs more detail without acknowledging the identified risk. Option D correctly identifies a weakness in the proposed solution – manual sanitization isn't scalable – but doesn't accurately reflect Alex's initial contribution to the security discussion.
21 / 26
Sarah's communication regarding the potential XSS vulnerability demonstrates a key principle of shift-left security. Her proactive reporting via a detailed PR description, coupled with proposed remediation steps (escaping input and suggesting robust validation), highlights the importance of identifying and addressing vulnerabilities early in the development lifecycle – ideally *before* deployment. This contrasts with waiting for a security team to find the issue after code is already live. Consider Sarah's approach in the context of a typical PR description.
The correct answer emphasizes Sarah's proactive approach – identifying the vulnerability in a PR description and suggesting solutions. This aligns with 'shift-left' which advocates for embedding security practices within development processes *before* deployment. Options A and B misrepresent her actions as reactive or solely symptom-focused, while option D is entirely inaccurate; option C correctly reflects the core principle of early vulnerability identification.
22 / 26
During a daily stand-up, Ben mentions 'shifting left' with security. Which of the following best describes his intended meaning?
Option A: Prioritizing post-deployment testing and patching. Option B: Integrating security considerations into every stage of the development lifecycle, starting early. Option C: Focusing solely on vulnerability scanning tools after code is complete. Option D: Delegating all security tasks to a dedicated security team.
Option A: Prioritizing post-deployment testing and patching. Option B: Integrating security considerations into every stage of the development lifecycle, starting early. Option C: Focusing solely on vulnerability scanning tools after code is complete. Option D: Delegating all security tasks to a dedicated security team.
Shifting left in security means proactively addressing vulnerabilities *before* they become major problems. It's about embedding security practices—like threat modeling and static analysis—into the development process itself, rather than treating it as an afterthought. Option A is a classic 'right-shift' approach; options C & D are misinterpretations of the concept.
23 / 26
Reviewer Maria comments on David's PR draft: 'This function uses string concatenation to build the SQL query. This is a significant risk for SQL injection vulnerabilities – we need input validation and parameterized queries.' What does Maria's comment *primarily* highlight regarding shift-left security?
Option A: The importance of using strong encryption algorithms. Option B: The necessity of early detection through static code analysis tools. Option C: The critical role of secure coding practices and proactive risk assessment during development. Option D: The requirement for frequent penetration testing after deployment.
Option A: The importance of using strong encryption algorithms. Option B: The necessity of early detection through static code analysis tools. Option C: The critical role of secure coding practices and proactive risk assessment during development. Option D: The requirement for frequent penetration testing after deployment.
Maria's comment directly addresses a common vulnerability—SQL injection—that arises from insecure coding practices. Shift-left security emphasizes identifying and mitigating these risks *before* the code is committed to production. Static analysis tools (like options B) are key to this early detection.
24 / 26
The API response for a user registration endpoint includes the following JSON: `{"status": "success", "message": "User created successfully"}`. If a developer discovers that this endpoint doesn't include any security-related metadata (e.g., vulnerability scan results, input validation checks), what does this *suggest* about their approach to shift-left security?
Option A: The API is perfectly secure and requires no further scrutiny. Option B: The developer should immediately request a full penetration test of the endpoint. Option C: The developer hasn't integrated security considerations into the API design or testing phase, indicating a potential 'right-shift' problem. Option D: The API response format is irrelevant to shift-left security practices.
Option A: The API is perfectly secure and requires no further scrutiny. Option B: The developer should immediately request a full penetration test of the endpoint. Option C: The developer hasn't integrated security considerations into the API design or testing phase, indicating a potential 'right-shift' problem. Option D: The API response format is irrelevant to shift-left security practices.
The absence of security metadata in the API response signals that security wasn't actively considered during development. Shift-left emphasizes proactive measures like vulnerability scanning and input validation checks – these should be documented *within* the API itself or its associated documentation. Option A is a dangerous assumption; Option B is an overreaction, and option D is incorrect.
25 / 26
During code review of a new feature implementing user profile updates, John writes the following in the PR description: 'Implemented data sanitization to prevent XSS attacks. Using HTML escaping for all output.' What aspect of shift-left security does this best illustrate?
Option A: Post-deployment vulnerability scanning. Option B: The use of a specific security library in the code. Option C: Proactively addressing potential vulnerabilities during development, rather than discovering them later. Option D: Automated patching after a successful security audit.
Option A: Post-deployment vulnerability scanning. Option B: The use of a specific security library in the code. Option C: Proactively addressing potential vulnerabilities during development, rather than discovering them later. Option D: Automated patching after a successful security audit.
John's description highlights *proactive* mitigation—specifically, implementing HTML escaping to prevent XSS. Shift-left emphasizes identifying and resolving risks early in the development lifecycle, not just reacting to them after deployment or during testing. Options A, B & D represent later stages of security operations.
26 / 26
Sarah is leading a discussion about improving the team's security posture. She argues for 'shift-left.' What is her primary goal?
Option A: To ensure all code has extensive static analysis coverage. Option B: To delay security discussions until the end of the sprint. Option C: To move security considerations earlier in the development lifecycle, reducing risk and cost. Option D: To solely rely on automated vulnerability scanners for identifying problems.
Option A: To ensure all code has extensive static analysis coverage. Option B: To delay security discussions until the end of the sprint. Option C: To move security considerations earlier in the development lifecycle, reducing risk and cost. Option D: To solely rely on automated vulnerability scanners for identifying problems.
Shift-left fundamentally means embedding security practices into every stage of development. This proactive approach minimizes risks and reduces costs associated with fixing vulnerabilities later in the process. Options A & D are partially correct but don't capture the full scope of shift-left.
Frequently Asked Questions
What does the "Shift-Left Security Communication Vocabulary" exercise cover?
Practice shift-left security vocabulary: moving security earlier in the SDLC, security champion programmes, developer security training, security by design, and threat modeling in sprints.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
How many questions are in "Shift-Left Security Communication Vocabulary"?
This exercise has 26 questions. Each one gives instant feedback with an explanation, so you can see exactly why an answer is right or wrong.
Do I need to create an account to save my progress?
No account is required. The progress bar and score are tracked in your browser for the current session -- the exercise is designed to be a quick, repeatable drill rather than something you resume later.
What happens if I get an answer wrong?
You'll see the correct answer highlighted immediately, along with a short explanation of why it's correct. Wrong answers aren't penalized beyond your score, and you can keep going through every question.
How is this exercise different from reading an article?
Articles explain vocabulary and concepts through prose, while exercises like this one are interactive drills -- multiple-choice questions -- that test and reinforce your recall of specific terms and phrasing.
Can I retry this exercise?
Yes -- use the "Try again" button on the results screen to reset your score and go through all the questions again from the start.
Where can I find more Devsecops Pipeline Language exercises?
Browse the full Devsecops Pipeline Language hub for related drills, or check the site-wide exercises index for other IT English topics.
Is this exercise suitable for beginners?
This exercise assumes basic familiarity with IT terminology. If a term feels unfamiliar, check the site Glossary for a plain-English definition before attempting the questions.
How often is new content like this published?
New exercises are added regularly across all categories, alongside new vocabulary sets and articles. Check back on the exercises hub to see what's new.