Zero trust and threat modeling are often presented as frameworks for large organisations. Both are simple ideas for any team: never trust the network, verify every request, and find threats on a whiteboard before production. With a STRIDE threat model of a real file upload feature.
Most DevSecOps advice starts at the pipeline: scanners, gates, signatures. The cheapest security fixes happen earlier, while a feature is still a ticket. How we add security requirements, abuse cases, a lightweight design review and security acceptance criteria to everyday planning without slowing teams down.
Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.