## 1 Introduction  
Cybersecurity has emerged as an essential pillar within the realm of Information Technology (IT), serving as the backbone to ensure the confidentiality, integrity, and availability of computing systems. This infrastructure underpins applications, software, and APIs across a wide array of sectors, including communication, education, industrial automation, entertainment, transportation, and finance [1], among others. Despite the plethora of programming languages and development methodologies enabling robust and accessible deployments, ensuring security across all layers of a product remains imperative [2]. A multi-layered security perspective--that is, one encompassing physical, network, access point, and application dimensions--is paramount to mitigate breaches and vulnerabilities that could compromise digital ecosystems and user safety. To this end, prominent authors such as [3; 4] posit that attaining a proactive and robust level of protection and resilience in cybersecurity necessitates the establishment of comprehensive observation points spanning multiple layers. These layers encompass aspects such as user behavior analysis, advanced threat modeling, rigorous vulnerability assessments, incident response frameworks, and the implementation of iterative continuous improvement strategies. Among the most pivotal elements to scrutinize is the software underpinning the information technology infrastructure, which serves as a cornerstone for ensuring systemic security and operational stability. As a consequence, the exploitation of vulnerabilities and breaches by malicious actors in unattended software, including source code, can lead to unauthorized access, data breaches, service disruptions, and financial losses, resulting in profoundly negative repercussions for organizations and human resources as well [5]. To address the inherent risks in software development, standards have been established under the SSDLC framework [6]. This paradigm incorporates review processes designed to identify potential threats and vulnerabilities in source code, thus reducing the likelihood of insecure production deployments. A key advantage of this strategy lies in prioritizing security across all development stages--from planning and design to implementation and controlled testing--ensuring rigorous scrutiny of code components, the implementation of mitigation measures, and overall enhancement of software quality. Nonetheless, despite its recognition as an industry standard, the adoption of SSDLC remains inconsistent. The escalating number of reported vulnerabilities in 2023--approximately 22,000, with 15% categorized as highly critical--underscores the persistence of security gaps [7; 8]. Several factors account for these deficiencies [9]: first, many organizations lack awareness of SSDLC practices, avoid them due to concerns about potential delays in production, or implement security controls grounded in obscurity, which prove to be ineffective in terms of the continuous detection and mitigation cycle; second, SSDLC relies on Static Application Security Testing (SAST) which, while effective in detecting known vulnerabilities, often produces a high volume of false positives due to the use of outdated databases or an inability to detect complex patterns such as obfuscated or encrypted code segments; and third, SSDLC assumes that Dynamic Application Security Testing (DAST) is carried out to complement SAST, analyzing code during execution. However, DAST lacks the requisite granularity at the source code level and typically necessitates additional manual reviews. The integration of DevSecOps practices into SSDLC pipelines, combined with Continuous Integration (CI) and Continuous Delivery/Deployment (CD) pipelines, has the potential to optimize both SAST and DAST processes [10].