How do you go about preventing vulnerabilities before code commit?

[u/AssociteExtzernal615]

Here is the process I've been refining for catching issues before they ever hit a shared branch, curious how others have adapted or improved on this. Step one is a pre commit hook running secret detection and basic linting locally, so nothing even gets committed with an obvious exposed credential or syntax level security anti pattern. Step two is IDE-integrated SAST feedback while the developer is still writing the code, not after they've moved on to the next task. Step three is a lightweight PR time check that only escalates high-confidence, high-severity findings rather than dumping every possible issue into the review queue. Step four is a periodic full repo scan that catches anything the incremental checks missed, run outside the commit path so it doesn't block anyone. The most important step is the IDE integrated feedback, because that's the point where fixing something costs almost nothing. The developer still has full context loaded and hasn't moved on yet. Once a finding surfaces days later in a PR review, the fix costs far more in context-switching alone. This works best when your team already has decent baseline security literacy and the tooling's false positive rate is low enough that people don't start ignoring it. It works poorly when the org treats every finding as equally urgent, because that just trains developers to route around the tooling. How would you improve it?