Empirically-Informed Approaches to Shift Vulnerability Detection to the Left

Shifting vulnerability detection left in the software development lifecycle improves product security by enabling early vulnerability detection, increasing remediation rates, and reducing exposure risk and remediation costs. However, highly effective vulnerability detection methods like fuzzing are resource-intensive and often conducted post-deployment, contradicting shift-left principles. This creates a need for effective validation tools that can be integrated into earlier development phases. To address this, my PhD research introduces three tools to help engineers validate security properties in code: a systematic testing framework for network protocol security, a runtime framework for validating security-sensitive behaviors in dependencies, and an automated tool for developing unit proofs to verify memory safety. Together, these tools empower engineers to validate critical security properties early in the development process.