Most shift-left talks end at the pull request. Dependabot opens a PR, your scanner opens a PR, and you call it shifted. But by then the vulnerable dependency is already committed, pushed, and flagged back to you days later. The shift-left happened on someone else's calendar.

This talk presents a developer-side workflow that catches outdated dependencies, missing requirements, and policy violations before code ever leaves the local machine, using pre-commit hooks, deterministic dependency pinning with pip-tools or uv, and a small set of linting and type checks wired into one fast commit-time gate.

It covers the classic failure it eliminates (a package installed locally, never pinned, that passes on your machine and breaks in CI), how this layer complements rather than replaces Dependabot and downstream scanners, and how to roll it out across a team without making developers hate you. Attendees leave with a working configuration they can adopt the same day.