# How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests

DevFeed: [How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests](<https://devfeed.tech/articles/how-to-catch-security-vulnerabilities-in-code-before-they-reach-your-pull-requests-20761.md>)

Original publisher: [Read original article](<https://www.freecodecamp.org/news/catch-security-vulnerabilities-code-pull-requests/>)

Author: Umair Mirza

Published: 2026-09-14T22:23:01Z

Content type: tutorial

Language: en

Sources: [freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More](<https://devfeed.tech/sources/freecodecamp-programming-tutorials-python-javascript-git-more.md>)

Topics: [Application Security](<https://devfeed.tech/topics/application-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Secret Scanning](<https://devfeed.tech/topics/secret-scanning.md>), [Git](<https://devfeed.tech/topics/git.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>), [ci](<https://devfeed.tech/topics/ci.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [.NET](<https://devfeed.tech/topics/net.md>), [Python](<https://devfeed.tech/topics/python.md>), [coding](<https://devfeed.tech/topics/coding.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [ci](<https://devfeed.tech/tags/ci.md>), [cli](<https://devfeed.tech/tags/cli.md>), [code](<https://devfeed.tech/tags/code.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [git](<https://devfeed.tech/tags/git.md>), [net](<https://devfeed.tech/tags/net.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [python](<https://devfeed.tech/tags/python.md>), [sast](<https://devfeed.tech/tags/sast.md>), [secret-scanning](<https://devfeed.tech/tags/secret-scanning.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [software-development](<https://devfeed.tech/tags/software-development.md>), [testing](<https://devfeed.tech/tags/testing.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This tutorial explains how to shift security checks earlier in development by running SAST locally with Git pre-commit hooks. It demonstrates using the DevSkim CLI to detect insecure coding patterns, pairing it with Gitleaks for dedicated secret scanning, validating the setup with an intentional failure, and enforcing the checks in CI.

## Source excerpt

Security reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia