(Victor Garber is a DevSecOps team leader in SanSec Pvt. Ltd. His organization develops various types of software products and web applications…

To identify vulnerabilities missed during pre-production stages (commit, build, test), security activities must be performed later in the CI/CD pipeline. Deploy-time checks, which occur as an application is pushed to a staging or production environment, are designed for this. These checks often include Dynamic Application Security Testing (DAST) and runtime monitoring. They are effective at finding configuration errors, business logic flaws, and other vulnerabilities that only manifest in a fully deployed, running application, thus complementing earlier static analysis.

B. Test-time checks are the pre-production activities that the question states have already been completed and may have missed certain vulnerabilities.

C. Commit-time checks happen at the earliest stage of the pipeline and are part of the pre-production testing that could have missed vulnerabilities.

D. Build-time checks, such as software composition analysis, are also a pre-production activity performed before the application is run in a realistic environment.

- Carnegie Mellon University, Software Engineering Institute (SEI). (2019). A Taxonomy of DevSecOps Tools. Section 3.3, "Deployment and Operations Phase Tools," describes how runtime analysis tools are used in the deployment phase to detect vulnerabilities not found earlier.

- NIST Special Publication 800-204A, Building Secure Microservices-based Applications Using Service-Mesh Architecture. (April 2020). Section 4.2, Figure 4, "Security Tools Mapped to CI/CD Pipeline," places DAST and Runtime Defense tools in the "Deploy/Release" stage of the pipeline.