Lean teams often postpone security “until there is time.” Time rarely appears on its own: controls have to fit the daily flow, not a separate project.
First: secrets and credentials
No keys in the repository. Use secret managers, CI scanning and rotation when exposure occurs. This is the best effort-to-risk control in week one.
Second: dependencies and containers
A software composition analysis (SCA) tool in the pipeline flags vulnerable libraries before deploy. For Docker images, pin base versions and rebuild with patches to shrink attack surface without blocking releases.
Third: human review where it matters
Automate the repetitive work; reserve manual review for changes to authentication, permissions or sensitive data. That way the team is not drowning in low-value alerts.
In this order, adoption cost stays manageable and risk drops from the first sprint.