A development team currently runs security scans only after code is deployed to a staging environment, which frequently discovers vulnerabilities late and forces costly rework. The security team wants to catch coding flaws such as SQL injection and insecure functions as early as possible in the CI/CD pipeline, ideally before the application is even built. Which practice should the team implement to best achieve this goal?