Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledge

Cloudflare outlines progress on CISA’s Secure-by-Design pledge, emphasizing prevention of injection vulnerabilities and secrets in code through custom SAST rules, CI/CD enforcement with build break, automation, and developer training; these measures produced a 79% reduction in secrets and a 44% reduction in potential SQL/code injection findings in the second half of 2024, with continued plans to scale secure defaults, threat modeling, and automated security tooling across the SDLC to reduce entire classes of vulnerabilities.