"Move fast and break things" is a non-starter for a citizen-facing system. But "audit everything before merge" produces a deployment cadence measured in months. Public-sector DevSecOps has to find the middle: secure-by-default pipelines that auditors trust, with feedback fast enough that engineers don't bypass them.
Our reference toolchain runs SAST in the IDE (so issues never reach a PR), DAST against an ephemeral staging environment per merge, and an SBOM generator that ships with every release. Policies are codified in OPA so a reviewer with no security background can still see why the gate fired - and exemptions are tracked in the same audit log auditors already read.