Security

The territory

30 core terms mapped for this field, ranked by how often builders reach for them. Each one is a future entry. Want to bust one? One entry, one file, one pull request.

• Threat modelMap of who attacks you, how, and what matters"list of ways this could get hacked" · "what are we actually defending against"
• Least privilegeGive each user or service only permissions strictly needed"don't give it admin for no reason" · "only the access it needs"
• Secrets managementStoring API keys and passwords outside code, injected at runtime"where do I put my API keys" · "stop hardcoding passwords"
• Secret scanningAutomated detection of committed keys in repos"did I commit my API key" · "catch leaked keys in the repo"
• Rate limitingCap requests per user or IP over a time window"stop one person hammering my API" · "max 100 requests per minute"
• Input validation and contextual output encodingRejecting bad input, then escaping output for its destination"input sanitization" · "make user input safe"
• XSS (cross-site scripting)Attacker's script runs in another user's browser"someone pasted a script tag and it ran" · "user input became code"
• SQL injectionAttacker input alters your database query"they typed something and stole the database" · "quote in a form broke my query"
• CSRF (cross-site request forgery)Another site tricks a logged-in user's browser into acting"an evil page submitted a form as me" · "clicking a link deleted my account"
• IDOR (insecure direct object reference)Changing an ID in a URL to view others' data"I changed the id and saw someone else's stuff" · "guessable record IDs"
• SSRF (server-side request forgery)Tricking your server into fetching attacker-chosen internal URLs"made my server fetch a URL it shouldn't" · "the server followed a link to internal stuff"
• Content Security Policy (CSP)Header restricting which scripts and resources a page may load"only let my own scripts run" · "allowlist for what the page can load"
• CORS (cross-origin resource sharing)Rules letting one origin's browser code call another's API"why is my API blocked in the browser" · "the origin error thing"
• Encryption at rest and in transitData scrambled on disk and while traveling the network"encrypt the database and the connection" · "locked both when stored and when sent"
• Password hashingOne-way scrambling so stored passwords can't be reversed"never save passwords as plain text" · "the bcrypt thing"
• Prompt injectionMalicious text hijacks an AI agent's instructions"user told my chatbot to ignore its rules" · "the AI obeyed the document instead of me"
• Supply chain attackCompromise arriving through a dependency or vendor you trust"an npm package went rogue" · "hacked through a library I installed"
• Dependency vulnerability scanningScanning installed packages for known vulnerabilities"npm audit" · "check my packages for holes"
• CVE (common vulnerabilities and exposures)Public ID for a known published software vulnerability"the numbered bug everyone panics about" · "that famous security hole"
• Row-level securityDatabase rules restricting which rows each user sees"the database only shows each user their own rows" · "RLS policies"
• Tenant isolationGuaranteeing one customer's data can never reach another"customer A must never see customer B's data" · "keeping accounts separate"
• Attack surfaceEvery entry point an attacker could possibly touch"all the doors into my app" · "everything exposed to the internet"
• Defense in depthLayered controls so one failure doesn't breach everything"multiple locks not one" · "backup security behind the security"
• WAF (web application firewall)Filter blocking malicious HTTP requests before your app"shield in front of my site" · "blocks the bad traffic automatically"
• Bot mitigationDistinguishing and blocking automated abuse from real users"stop scrapers and fake signups" · "keep the robots out"
• Data breachUnauthorized access to or exfiltration of user data"our user list leaked" · "someone got the customer data"
• Incident response planPrewritten steps for detecting, containing, communicating a breach"what to do when we get hacked" · "the emergency playbook"
• Security headersHTTP response headers hardening browser behavior on your site"those headers scanners yell about" · "HSTS and friends"
• Secure by defaultShip with the safest configuration unless deliberately loosened"locked down out of the box" · "private until you make it public"
• Blast radiusHow much damage a single compromised credential can cause"how bad if this key leaks" · "how far the damage spreads"

Deeper in the field

• Vulnerability Weakness attackers can exploit to compromise confidentiality, integrity, or availability
• Exploit Code or technique that takes advantage of a vulnerability
• Attack vector Route or method an attacker uses to reach a target
• OWASP Top 10 Widely used catalog of critical web application security risks
• Broken access control Users access data or actions beyond their intended permissions
• Privilege escalation Low-access account gaining higher permissions than intended
• Command injection Untrusted input causes operating-system commands to run on your server
• Remote code execution (RCE) Flaw allowing attackers to execute code remotely on your system
• Path traversal Using `../` in paths to read unintended files
• Unrestricted file upload Unsafe uploads enable malware hosting, overwrites, or server-side execution
• Clickjacking Invisible overlay tricks users into clicking hidden controls
• Replay attack Captured valid requests are resent to repeat unauthorized actions
• Security misconfiguration Unsafe settings or defaults expose systems, services, or sensitive data
• Hardening Removing defaults, ports, and features to shrink exposure
• Zero trust Verify every request; no network location is inherently trusted
• Sandboxing Running untrusted code isolated from your system and data
• Password salting and peppering Random per-password value plus secret making hashes unguessable
• Key rotation Regularly replacing credentials so leaked ones expire
• Vulnerability scanning Automated checks for known weaknesses in applications, hosts, and dependencies
• SAST (static application security testing) Scans source code for security weaknesses without executing the application
• DAST (dynamic application security testing) Probes a running application externally for exploitable security flaws
• CVSS (common vulnerability scoring system) Standard score describing a published vulnerability's technical severity
• Penetration test Hired attackers probe your system and report findings
• Bug bounty Paying researchers for responsibly reported vulnerabilities
• Vulnerability disclosure policy Public instructions for reporting security bugs to you
• Dependency confusion Malicious public package is chosen over the intended internal package
• Typosquatting Malicious package or domain named like a popular one
• SBOM (software bill of materials) Machine-readable inventory of every component you ship
• Subdomain takeover Attacker claims your dangling DNS-pointed subdomain
• Audit log Immutable record of who did what and when
• Tokenization Replacing sensitive values with meaningless lookup substitutes
• Redaction / masking Hiding parts of sensitive values in logs and UI
• Ransomware Malware encrypting your data until payment is made