Which of the following security practices should occur initially in software development?

Which of the following security practices should occur initially in software development?

A.
Secure code review

B.
Patch management

C.
Fuzzing

D.
Penetration tests