Lessons learned while following a security-first approach to allow long-term maintenance and active contributions. These approaches are not specific to one project but can be applied to any software project. This article was written for anyone interested in learning DevSecOps and a security-first approach to software development.