In the ancient times of software creation, we had AppSec, and we had developers. Generally, AppSec was aware of security problems and potential fixes. Developers cranked out features in a fast, functional way, but released their code for security review as late as possible. Why? To shorten the AppSec feedback window, ensuring their out-of-context recommendations would hit after the release window and not halt proceedings. Today, the DevSecOps movement creates an optimum environment of shared responsibility for security, and with the right training and tools, security-aware developers can take advantage.