Developers aren't used to security lifecycle so quite a few commenters in this thread equates SDLC and Security