The direct cause of the 2019 Capital One breach that leaked 106 million customers' data was an SSRF vulnerability in a WAF, but the real reason it grew into an incident that large is that nowhere in the build pipeline was there an automated security gate that could catch SSRF. One line of SAST, one code review step, one IMDS hop-limit check wired into the PR stage would have stopped the incident before it happened. DevSecOps' "Shift Left" is the work of moving those gates from operations (right) to PR/IDE (left).