Security

Busted

• Attack surfaceEvery door, window, and vent into your system: routes, forms, uploads, ports, dependencies, admin panels. Count them, then delete what you can.
• Attack vectorThe path an attacker takes into a target, such as a phishing email, public API, unsafe upload, stolen password, or poisoned dependency.
• Audit log (security events)A tamper-resistant history of sensitive actions that answers who did what, to which resource, when, and whether it worked.
• Blast radiusHow much an attacker gets if one credential, service, or account is compromised. The honest answer to 'how bad if this leaks'.
• Bot mitigationTelling automated traffic apart from real people, then blocking, slowing, or challenging the bad half without punishing everyone else.
• Broken access controlThe server lets a user read data or perform an action their account, role, or tenant was never supposed to reach.
• Bug bountyA program that rewards outside researchers for responsibly finding and reporting real security holes in systems you put in scope.
• ClickjackingA page hides a real button under a harmless-looking one, tricking you into clicking an action you never meant to approve.
• Command injectionUntrusted text gets pasted into a shell command, letting an attacker turn a filename or form value into commands your server runs.
• Content Security Policy (CSP)A header telling the browser which scripts, styles and connections a page may load, so injected code is refused before it runs.
• CORS (cross-origin resource sharing)The browser rule that page code may only read another origin's response if that server says yes, which is why curl works and the tab does not.
• CSRF (cross-site request forgery)Another site quietly makes your browser fire a real logged-in request at your app, and your app cannot tell the user did not mean it.
• CVE (common vulnerabilities and exposures)The public ID number for one specific known security hole, like CVE-2021-44228 (Log4Shell), so everyone can name the same bug.
• CVSS (common vulnerability scoring system)The 0-to-10 number attached to a vulnerability, describing its technical severity but not how dangerous it is to your exact system.
• DAST (dynamic application security testing)A scanner that attacks a running app from the outside, looking for security holes visible through its real pages and APIs.
• Data breachData you were trusted with gets seen, taken, altered, or destroyed by someone who should not have touched it, whether by an attacker or by accident.
• Defense in depthStacking independent security controls so that when one fails, and one will, the next one still stops the attacker.
• Dependency confusionA build installs an attacker's public package because it has the same name as your intended private dependency and wins resolution.
• Dependency vulnerability scanningAutomatically matching your installed packages against a database of known holes, so you hear about a bad version before an attacker uses it.
• Encryption at rest and in transitScrambling data twice: once while it sits on disk, once while it crosses the network. A stolen drive or a sniffed connection gets noise.
• ExploitThe code, payload, or sequence of steps that turns a security weakness into an actual break-in or other harmful result.
• HardeningThe security cleanup pass: remove unused software and features, close spare ports, drop privileges, and tighten every permissive default.
• IDOR (insecure direct object reference)The URL or request body names a record by id and the server hands it over without checking that this user is allowed to have it.
• Incident response planThe document that says who to call, what to shut off, and what to tell users, written before the bad day rather than during it.
• Input validation and contextual output encodingTwo separate jobs: reject junk input at the door, then escape whatever you print so it cannot turn into code where it lands.
• Key rotationReplacing credentials in a controlled overlap, moving traffic to the new key, then revoking the old one before a leak can stay useful.
• Least privilegeGive every user, key, and service the smallest set of permissions that still lets it do its job, and nothing spare.
• OWASP Top 10OWASP's short list of major web application risk families, used to start security reviews and give teams a shared checklist.
• Password salting and pepperingA unique public salt makes every password hash different; a separate secret pepper makes a stolen hash database harder to crack by itself.
• Path traversalA filename or URL uses ../ or an equivalent trick to escape the intended folder and make the server open a different file.
• Penetration testA scoped, authorized attempt by hired security testers to break into your system, followed by evidence, fixes, and a retest.
• Privilege escalationA low-access user or process finds a path to stronger powers, such as becoming an admin, another user, or root.
• RansomwareMalware locks or encrypts your systems and demands payment, often after stealing the data so the attacker can threaten to publish it too.
• Redaction / maskingHide all or part of a sensitive value before it reaches logs or screens, while leaving only the detail someone genuinely needs.
• Remote code execution (RCE)A flaw that lets someone across the network make your server run code they chose, with whatever access that process already has.
• Replay attackReusing a captured request that was valid once, so the same payment, login, command, or other action happens again.
• SandboxingRunning untrusted code in a small, disposable environment that cannot freely reach your files, network, credentials, or operating system.
• SAST (static application security testing)A security scanner that reads your code without running the app, catching risky patterns while they are still in a pull request.
• SBOM (software bill of materials)A machine-readable ingredient list for one software release, recording the exact packages and components you actually shipped.
• Secret scanningAutomated hunting for API keys and passwords committed to your repo or its history, ideally before anyone else finds them.
• Secrets managementKeeping API keys and passwords out of your code, stored somewhere encrypted and handed to the app at runtime instead.
• Secure by defaultShip with the locked-down setting on, so anything riskier takes a deliberate act to enable. Private first, public on purpose.
• Security headersHTTP response headers that tell the browser to be stricter: force HTTPS, block framing, restrict scripts, stop leaking referrers.
• Security misconfigurationA safe system deployed with unsafe settings, such as debug mode, public storage, default passwords, open admin ports, or excess permissions.
• SQL injectionUser input your database runs as part of the query instead of treating as data, so a typed quote can read or wreck everything.
• SSRF (server-side request forgery)You let a user hand your server a URL to fetch, and they point it at your own internal network instead.
• Subdomain takeoverAn attacker claims a deleted service that your DNS still points to, then serves their content from your trusted subdomain.
• Supply chain attackGetting breached through code you trusted and installed: a package, a plugin, a build tool, a vendor. Your own pipeline delivers the attack.
• Tenant isolationGuaranteeing one customer's data can never appear in another customer's account, no matter which query, cache, or background job touches it.
• Threat modelA written map of who might attack your app, how they would try it, and which of those attacks you actually plan to stop.
• TokenizationSwap sensitive data for a meaningless lookup token, so most of your system can use a reference without seeing the real value.
• TyposquattingA malicious package or website with a nearly correct name, waiting for someone to mistype or skim past the difference.
• Unrestricted file uploadAn upload feature accepts files too freely, letting people host malware, overwrite data, fill storage, or make the server run uploaded code.
• VulnerabilityA weak spot in code or configuration that an attacker can use to read, change, or disrupt something they should not reach.
• Vulnerability disclosure policyThe public page that tells security researchers what they may test, where to report a hole, and how your team will respond.
• Vulnerability scanningAutomated checks that look for known security weaknesses in your code, packages, container images, servers, settings, and running app.
• WAF (web application firewall)A filter in front of your app that reads every HTTP request and drops the ones that look like attacks before your code sees them.
• XSS (cross-site scripting)Attacker text gets rendered as real code in someone else's browser, so their script runs with your victim's session.
• Zero trustNo automatic trust for being inside the network: every request must prove who it is and be authorized for the exact resource it wants.

The territory

30 core terms mapped for this field, ranked by how often builders reach for them. Each one is a future entry. Want to bust one? One entry, one file, one pull request.

• Threat modelMap of who attacks you, how, and what matters"list of ways this could get hacked" · "what are we actually defending against"
• Least privilegeGive each user or service only permissions strictly needed"don't give it admin for no reason" · "only the access it needs"
• Secrets managementStoring API keys and passwords outside code, injected at runtime"where do I put my API keys" · "stop hardcoding passwords"
• Secret scanningAutomated detection of committed keys in repos"did I commit my API key" · "catch leaked keys in the repo"
• Rate limitingCap requests per user or IP over a time window"stop one person hammering my API" · "max 100 requests per minute"
• Input validation and contextual output encodingRejecting bad input, then escaping output for its destination"input sanitization" · "make user input safe"
• XSS (cross-site scripting)Attacker's script runs in another user's browser"someone pasted a script tag and it ran" · "user input became code"
• SQL injectionAttacker input alters your database query"they typed something and stole the database" · "quote in a form broke my query"
• CSRF (cross-site request forgery)Another site tricks a logged-in user's browser into acting"an evil page submitted a form as me" · "clicking a link deleted my account"
• IDOR (insecure direct object reference)Changing an ID in a URL to view others' data"I changed the id and saw someone else's stuff" · "guessable record IDs"
• SSRF (server-side request forgery)Tricking your server into fetching attacker-chosen internal URLs"made my server fetch a URL it shouldn't" · "the server followed a link to internal stuff"
• Content Security Policy (CSP)Header restricting which scripts and resources a page may load"only let my own scripts run" · "allowlist for what the page can load"
• CORS (cross-origin resource sharing)Rules letting one origin's browser code call another's API"why is my API blocked in the browser" · "the origin error thing"
• Encryption at rest and in transitData scrambled on disk and while traveling the network"encrypt the database and the connection" · "locked both when stored and when sent"
• Password hashingOne-way scrambling so stored passwords can't be reversed"never save passwords as plain text" · "the bcrypt thing"
• Prompt injectionMalicious text hijacks an AI agent's instructions"user told my chatbot to ignore its rules" · "the AI obeyed the document instead of me"
• Supply chain attackCompromise arriving through a dependency or vendor you trust"an npm package went rogue" · "hacked through a library I installed"
• Dependency vulnerability scanningScanning installed packages for known vulnerabilities"npm audit" · "check my packages for holes"
• CVE (common vulnerabilities and exposures)Public ID for a known published software vulnerability"the numbered bug everyone panics about" · "that famous security hole"
• Row-level securityDatabase rules restricting which rows each user sees"the database only shows each user their own rows" · "RLS policies"
• Tenant isolationGuaranteeing one customer's data can never reach another"customer A must never see customer B's data" · "keeping accounts separate"
• Attack surfaceEvery entry point an attacker could possibly touch"all the doors into my app" · "everything exposed to the internet"
• Defense in depthLayered controls so one failure doesn't breach everything"multiple locks not one" · "backup security behind the security"
• WAF (web application firewall)Filter blocking malicious HTTP requests before your app"shield in front of my site" · "blocks the bad traffic automatically"
• Bot mitigationDistinguishing and blocking automated abuse from real users"stop scrapers and fake signups" · "keep the robots out"
• Data breachUnauthorized access to or exfiltration of user data"our user list leaked" · "someone got the customer data"
• Incident response planPrewritten steps for detecting, containing, communicating a breach"what to do when we get hacked" · "the emergency playbook"
• Security headersHTTP response headers hardening browser behavior on your site"those headers scanners yell about" · "HSTS and friends"
• Secure by defaultShip with the safest configuration unless deliberately loosened"locked down out of the box" · "private until you make it public"
• Blast radiusHow much damage a single compromised credential can cause"how bad if this key leaks" · "how far the damage spreads"

Deeper in the field

• Vulnerability Weakness attackers can exploit to compromise confidentiality, integrity, or availability
• Exploit Code or technique that takes advantage of a vulnerability
• Attack vector Route or method an attacker uses to reach a target
• OWASP Top 10 Widely used catalog of critical web application security risks
• Broken access control Users access data or actions beyond their intended permissions
• Privilege escalation Low-access account gaining higher permissions than intended
• Command injection Untrusted input causes operating-system commands to run on your server
• Remote code execution (RCE) Flaw allowing attackers to execute code remotely on your system
• Path traversal Using `../` in paths to read unintended files
• Unrestricted file upload Unsafe uploads enable malware hosting, overwrites, or server-side execution
• Clickjacking Invisible overlay tricks users into clicking hidden controls
• Replay attack Captured valid requests are resent to repeat unauthorized actions
• Security misconfiguration Unsafe settings or defaults expose systems, services, or sensitive data
• Hardening Removing defaults, ports, and features to shrink exposure
• Zero trust Verify every request; no network location is inherently trusted
• Sandboxing Running untrusted code isolated from your system and data
• Password salting and peppering Random per-password value plus secret making hashes unguessable
• Key rotation Regularly replacing credentials so leaked ones expire
• Vulnerability scanning Automated checks for known weaknesses in applications, hosts, and dependencies
• SAST (static application security testing) Scans source code for security weaknesses without executing the application
• DAST (dynamic application security testing) Probes a running application externally for exploitable security flaws
• CVSS (common vulnerability scoring system) Standard score describing a published vulnerability's technical severity
• Penetration test Hired attackers probe your system and report findings
• Bug bounty Paying researchers for responsibly reported vulnerabilities
• Vulnerability disclosure policy Public instructions for reporting security bugs to you
• Dependency confusion Malicious public package is chosen over the intended internal package
• Typosquatting Malicious package or domain named like a popular one
• SBOM (software bill of materials) Machine-readable inventory of every component you ship
• Subdomain takeover Attacker claims your dangling DNS-pointed subdomain
• Audit log Immutable record of who did what and when
• Tokenization Replacing sensitive values with meaningless lookup substitutes
• Redaction / masking Hiding parts of sensitive values in logs and UI
• Ransomware Malware encrypting your data until payment is made