A development team runs a CI/CD pipeline that builds container images, deploys them to a Kubernetes cluster, and exposes a web application. The security team wants to adopt a 'shift-left' DevSecOps practice that catches vulnerabilities in the application's own source code as early as possible—before any artifact is built. Which control should be integrated into the pipeline to meet this requirement?