How to move security feedback earlier while keeping findings relevant, owned, and actionable.