Glossary

Account lockout: Refusing logins for an account after a number of failed attempts within an observation window, for a lockout duration (OWASP Authentication Cheat Sheet).; Slowing down guessing
ACME: The protocol of RFC 8555: a client sends signed JSON over HTTPS to a CA to open an account, order a certificate, prove control of each name and download the result.; Certificates that renew themselves
Actuator endpoint: A Spring Boot URL under /actuator for operations: health, env, threaddump, heapdump, and gateway in Spring Cloud Gateway.; Attack surface: what an attacker can reach
Advisory: A published notice for one vulnerability: the package, the vulnerable version ranges, the first patched version for each, and a severity. GitHub gives each one a GHSA- id.; Responding to an advisory
AEAD: Authenticated encryption with associated data: one call encrypts the message and adds a tag, and decryption fails if a single byte was changed. AES-GCM and ChaCha20-Poly1305 are AEADs.; Using crypto correctly
Affected range: The versions that contain the bug, here libcurl 7.69.0 up to and including 8.3.0. Versions before the bug came in are not affected.; Reading a CVE
Alert fatigue: People on call stop reading alerts of a kind when nearly all of them have been false positives, and so they miss the real one.; Detecting an attack
alg: The header field that names the signing algorithm, such as RS256 (RSA signature) or HS256 (HMAC with a shared secret). The sender of the token chooses it.; JWT pitfalls
Algorithm confusion: Tricking a verifier into checking a signature with a different algorithm than the issuer used, for example HMAC keyed with the issuer’s RSA public key.; JWT pitfalls
Allow-list: A fixed list of accepted inputs in the code, such as {"name": "last_name", "age": "age"}. The code refuses any input that is not a key of that list.; SQL injection
Allow-list: The list of fields and values the code accepts. The code drops or rejects every other field. The Rails security guide calls it a "permitted list".; Validating input at the boundary
ARI: ACME Renewal Information: the CA tells the client a window in which to renew each certificate, and can move that window earlier, for example before a mass revocation.; Certificates that renew themselves
Attack surface: OWASP: "all of the different points where an attacker could get into a system, and where they could get data out." Ports, URLs, file inputs, message queues and the code behind each one.; Attack surface: what an attacker can reach
Audit level: How much of a request Kubernetes records: None, Metadata (user, time, verb, resource), Request (plus the request body) or RequestResponse (plus the response body).; Logs that help after a breach
Audit log: A record of security events in time order: who acted, on what, from where, when, and with what result. Kubernetes writes one per API request when kube-apiserver gets an audit policy.; Logs that help after a breach
Authentication: Checking who the caller is: a password, a session cookie, a token. The answer is a user id, or "anonymous".; Authorization: who may do what
Authorization: Checking whether that caller may perform this action on this resource. It runs after authentication, on every request.; Authorization: who may do what
Authorization code: A short-lived, single-use string the login server puts in the redirect back to the app. The app trades it for an access token at the token endpoint. RFC 6749 recommends a lifetime of 10 minutes at most.; OAuth 2 in plain words
Backport: A fix copied by a distribution into the older version it ships. The package version changes, for example to 7.88.1-10+deb12u4, while the upstream number stays 7.88.1.; Reading a CVE
Base64: A way to write any bytes with 64 printable characters. Anyone can reverse it with base64 -d, and no key is involved.; Where secrets live
Bearer token: A string that proves a past login. Whoever holds it is treated as its owner, with no further check.; Logs that help after a breach
Blast radius: Everything an attacker can do with one stolen credential before it expires or someone revokes it.; Least privilege
CA store: The file or folder of root CA certificates a client trusts. requests uses the bundle from the certifi package; curl uses one chosen at build time.; TLS in one handshake
Canonical path: The single absolute form of a path, with . and .. resolved. Python’s os.path.realpath also follows symbolic links to build it.; Path traversal
Capability: One piece of root’s power in Linux, such as CAP_NET_RAW (raw sockets) or CAP_CHOWN (change file owners). Docker keeps 14 of them for a container by default.; Hardening a container
Certificate chain: The list the server sends in its Certificate message: its own certificate first, then each CA certificate that signed the one before it.; TLS in one handshake
CertificateVerify: A handshake message where the server signs the whole handshake so far with the private key that matches the certificate it just sent.; TLS in one handshake
Challenge: A task the CA sets to check that you control a name. http-01 asks for a file at http://<domain>/.well-known/acme-challenge/<token>, dns-01 for a TXT record at _acme-challenge.<domain>.; Certificates that renew themselves
check --deploy: The Django command manage.py check --deploy. It runs the extra checks registered with deploy=True, which test settings such as DEBUG, ALLOWED_HOSTS and SECRET_KEY.; Secure defaults
code_challenge: With method S256, the base64url-encoded SHA-256 hash of the code_verifier. The app sends it in the first request, and the server stores it with the code.; OAuth 2 in plain words
code_verifier: A random string of 43 to 128 characters that the app creates for one login and keeps to itself until the token request.; OAuth 2 in plain words
Containment: The actions that stop the attacker from going further: cut the stolen account, cut other access paths, replace hosts that may still run the attacker’s code.; When you are breached
Content Security Policy: A response header, Content-Security-Policy, that lists where the page may load scripts, styles, images and other resources from. The browser refuses what the policy does not allow.; Content Security Policy
Contextual escaping: Encoding a value for the exact place it is inserted: HTML text, an attribute, a URL or a JavaScript string. Each place needs a different encoding.; Cross-site scripting
Credential stuffing: Trying username and password pairs taken from the breach of another site (OWASP). It works on every user who reused a password.; Slowing down guessing
CSPRNG: A cryptographically secure random number generator: its output cannot be predicted from earlier output. Go’s crypto/rand and Python’s secrets are CSPRNGs; math/rand and random are not.; Using crypto correctly
CSRF: Cross-site request forgery: a page on another site makes the victim’s browser send a request to your app, and the browser attaches the victim’s cookies to it.; Cross-site request forgery
CSRF token: A random value the server puts in its own pages and checks on every unsafe request. A page on another site cannot read it, so it cannot send it.; Cross-site request forgery
CVE ID: A name like CVE-2023-38545 for one vulnerability, so every advisory, scanner and changelog can point at the same bug.; Reading a CVE
CVSS vector: A line like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H that gives one letter per base metric. The 0 to 10 base score is computed from it.; Reading a CVE
Data flow diagram: A drawing of the processes, data stores, external entities and data flows of a feature. It is the map you walk through when you ask what can go wrong.; Threat modeling a feature
Default deny: A policy with an empty podSelector and no rules. It selects every Pod in the namespace and allows nothing, so other policies then open only what you list.; Network policies
Defence in depth: Several independent controls on the same attack path, so an attacker has to beat each one. When one fails, the next still has to be beaten.; Layers of defence
Deny-list: A list of known bad fields or values to block, such as admin. Everything not on it gets through. The Rails guide calls it a "restricted list".; Validating input at the boundary
Dependency confusion: Publishing a public package under the name of a company's internal package, with a higher version, so that a build that checks both registries installs the public one.; Pinning what you install
Deserialization: Turning stored or received bytes (YAML, JSON, a pickle) back into objects in memory. OWASP: "taking data structured in some format, and rebuilding it into an object."; Unsafe deserialization
Detection rule: A condition on an event, plus an output line and a priority. In Falco: condition: open_write and container and fd.name endswith release_agent ....; Detecting an attack
Discriminator: In Rack::Attack, the value a throttle counts by: the client IP, a normalized email, or anything the block returns. A nil discriminator means the request is not counted.; Slowing down guessing
Distroless image: A base image from Google’s distroless project with the app’s runtime dependencies and no package manager or shell.; Hardening a container
DNS rebinding: A hostname resolves to a public IP when the app checks it and to an internal IP when the app connects. GitLab's docs: it makes "a malicious domain name resolve to an internal network resource".; Server-side request forgery
Encryption at rest: The API server encrypts each Secret before it writes it to etcd, with a key etcd never sees. Kubernetes turns it on only when you give kube-apiserver an EncryptionConfiguration file.; Where secrets live
Escape hatch: A framework feature that inserts a string with no escaping: template.HTML in Go, {@html} in Svelte, dangerouslySetInnerHTML in React.; Cross-site scripting
exp: The expiry claim: a Unix time in seconds after which the token must be refused. A verifier that finds no exp has no date after which to refuse the token.; JWT pitfalls
Exposure: The Spring Boot setting management.endpoints.web.exposure.include: the list of endpoint ids that answer over HTTP. Its default is health.; Attack surface: what an attacker can reach
False positive: An alert on harmless activity, such as systemd reading /etc/shadow during an SSH login.; Detecting an attack
File signature: The first bytes of a file, which identify its format. A JPEG starts with the bytes FF D8 FF.; File uploads
Fixed window: A counter that starts again at each multiple of the period. With a 20-second period, Unix times 1,000,000 to 1,000,019 share one counter, and 1,000,020 starts a new one.; Slowing down guessing
Fulcio: The Sigstore certificate authority. It checks an OpenID Connect token and issues an X.509 certificate valid for 10 minutes, with the identity from the token in it.; Signing what you ship
GITHUB_TOKEN: A token GitHub creates at the start of each workflow job. It works only on the repository of the workflow, has the permissions set by permissions:, and expires when the job finishes or after 24 hours at most.; Least privilege
Hash: A one-way function: from the password you get the hash, and nothing turns the hash back into the password. To check a login, you hash the attempt and compare.; Storing passwords
History rewrite: Rebuilding commits without a file, for example with git-filter-repo, then force pushing. Every later commit gets a new SHA.; Secrets in git
Hostname check: The client compares the name in the URL with the DNS names in the certificate's Subject Alternative Name. A valid chain for *.badssl.com fails it on github.com.; TLS in one handshake
HttpOnly and Secure: Two Set-Cookie attributes. HttpOnly hides the cookie from document.cookie. Secure sends it only over https:, except on localhost.; Sessions and cookies
IDOR: Insecure direct object reference: the request carries an id (/invoices/1042, user_field_ids=7) and the server returns that object without checking that the caller may access it.; Authorization: who may do what
Indicator of compromise: A concrete trace of the attacker that others can search for: an IP address, a file path, a file hash, a domain, an audit log action.; When you are breached
Integrity: The integrity field of a lockfile entry: a sha512 or sha1 Subresource Integrity string of the tarball that was unpacked.; Pinning what you install
Isolated Pod: A Pod selected by at least one policy for a direction. For that direction, only the connections some policy allows get through. A Pod no policy selects accepts everything.; Network policies
JWT: JSON Web Token: three base64url parts joined by dots, header.payload.signature. Anyone holding the token can decode and read the first two parts.; JWT pitfalls
Key authorization: The string the challenge checks: the token, a dot, then the base64url SHA-256 thumbprint of the client's account key.; Certificates that renew themselves
Keyless signing: cosign creates a key pair, signs once, and throws the private key away. A short-lived certificate records who held the key.; Signing what you ship
Kubernetes Secret: An API object that holds a few named values, up to 1 MiB, which Pods read as environment variables or as files. Its data values are base64 text.; Where secrets live
Least privilege: Each process, user and token gets only the permissions its task needs, for only as long as it needs them.; Least privilege
Lexical check: A check on the path string only, like Go’s filepath.IsLocal. It never reads the disk, so it cannot see where a symbolic link points.; Path traversal
Link-local address: An address in 169.254.0.0/16 (IPv4) or fe80::/10 (IPv6), reachable only on the local network segment. The metadata IP is one of them.; Server-side request forgery
Listening socket: A port a process has opened to accept connections. ss -tlnp lists the TCP ones with the address and the process. 0.0.0.0 means every network interface, 127.0.0.1 means this machine only.; Attack surface: what an attacker can reach
Lockfile: A file that records the exact tree an install produced: every package, its version, where it came from and a hash. npm writes package-lock.json, which is "intended to be committed into source repositories".; Pinning what you install
Mass assignment: Passing a whole request hash to a model in one call, as in Person.create(params[:person]). Every key in the request sets the attribute of the same name.; Validating input at the boundary
Metadata service: An HTTP endpoint on cloud VMs at 169.254.169.254 that answers questions about the instance. On AWS this service is called IMDS.; Server-side request forgery
Middleware: Code that runs on every request before the route handler. In Next.js, many apps used it to read the session cookie and redirect visitors who are not logged in.; Trust boundaries
Mode: What the controller does on a violation: enforce rejects the Pod, audit adds an annotation to the audit log, warn returns a warning to the user.; Pod Security Standards
Multipart upload: The multipart/form-data body a form sends. Each file part carries a filename and a Content-Type header, and the client writes both.; File uploads
Network plugin: The CNI component that enforces policies. The docs: a NetworkPolicy "without a controller that implements it will have no effect".; Network policies
NetworkPolicy: A namespaced Kubernetes object that selects Pods by label and lists the connections allowed into them (ingress) and out of them (egress).; Network policies
no-new-privileges: A Docker security option that stops container processes from gaining new privileges. The Docker docs: commands such as su or sudo "no longer work".; Hardening a container
Nonce: A random value the server puts both in the header (script-src 'nonce-R4nd0m') and on each of its own <script nonce="R4nd0m"> tags. It must be new for every response.; Content Security Policy
Nonce: A value passed with each encryption that must never repeat for the same key. AES-GCM uses 12 bytes (96 bits).; Using crypto correctly
Origin binding: In WebAuthn, the browser writes the origin of the page into the signed login data, and the key only signs for the site it was registered with. A response made on cloudflare-okta.com fails the check for cloudflare.com.; Layers of defence
os.Root: A Go 1.24 type that holds an open directory. Its methods refuse any file name that would leave that directory through .. or a symbolic link.; Path traversal
OSV record: A vulnerability in the Open Source Vulnerability JSON format: an id, aliases such as the CVE, and affected entries naming a package and the version ranges it is vulnerable in.; Vulnerable dependencies
Override: A root package.json entry that forces one version of a package everywhere in the tree, whatever version your dependencies ask for.; Vulnerable dependencies
Parameterized query: The SQL text holds placeholders such as %s, and the values go to the driver in a separate list: cursor.execute(sql, [value]).; SQL injection
Patched version: The first release that has the fix on a given line. For semver: 7.5.2 for 7.x, 6.3.1 for 6.x and 5.7.2 for everything older.; Responding to an advisory
Path traversal: An attack where a file name from outside, like ../../etc/passwd, makes a program open a file outside the directory it meant to use.; Path traversal
Phishing-resistant: An authenticator whose output is bound to the site it is used on, so a fake site cannot pass it on to the real one. NIST counts no code that the user types as phishing-resistant.; Second factors
Pickle: Python’s own binary serialization format. Loading a pickle can import and call any function named in the data.; Unsafe deserialization
Placeholder: The marker for one value in a parameterized query: %s in Django, ? in a Java PreparedStatement. It can stand for a value only, never for a table or column name.; SQL injection
Pod Security Admission: The admission controller built into the API server, stable since 1.25. It checks Pods against a level when they are created.; Pod Security Standards
Pod Security Standards: Three policy levels defined by Kubernetes: privileged (no restriction), baseline (blocks known privilege escalations) and restricted (current hardening practice).; Pod Security Standards
Protected mode: A Redis setting, on by default since 3.2. When the default user has no password, Redis only accepts connections from 127.0.0.1, ::1 or a Unix socket.; Secure defaults
Provenance: A signed record of how an artifact was built: which build platform, from which source repository and commit, with which parameters.; Supply chain attacks
Public client: An app that cannot keep a secret, such as a mobile app or a single-page app. Anyone can unpack it and read any client secret inside.; OAuth 2 in plain words
Push protection: A GitHub check that scans a push for known secret formats and blocks it before the commits reach the repository.; Secrets in git
RBAC: Role-based access control: permissions are attached to roles such as admin or moderator, and a user gets the permissions of their roles.; Authorization: who may do what
Re-encoding: Decoding an uploaded image to pixels and writing a new file in a format you chose, without the original metadata.; File uploads
Reachability: Whether your program can actually call the vulnerable function. govulncheck checks it on the call graph built from your source.; Vulnerable dependencies
Read-only root filesystem: The container’s own files are mounted read-only with --read-only. Writes go only to the volumes and tmpfs mounts you list.; Hardening a container
Real-time phishing: A fake login page that forwards what the victim types to the attacker within seconds, so the attacker can use a one-time code before it expires.; Layers of defence
Recipe: A high-level API that picks the algorithm, the nonce and the format for you, like Python’s Fernet or Go’s cipher.NewGCMWithRandomNonce.; Using crypto correctly
ReDoS: Regular expression denial of service: an input that makes a regex backtrack for a very long time, so the process spends its CPU on one string.; Responding to an advisory
Reflected XSS: The script travels in the request, such as /search?q=<script>…, and the server copies it into the response. The victim gets it by clicking a crafted link.; Cross-site scripting
Rekor: The Sigstore transparency log: an append-only public log of each signature, its certificate and the digest of the signed file.; Signing what you ship
Release tarball: The .tar.gz a project publishes for each version. Debian imported the xz tarball, not the git tree, for its package. A tarball can contain files that are in no commit.; Supply chain attacks
Report-only mode: The same policy sent as Content-Security-Policy-Report-Only. The browser enforces nothing and only reports what it would have blocked.; Content Security Policy
Reset token: The secret string in the link of a reset email. Whoever holds it can set a new password for the account.; Threat modeling a feature
Retention period: The number of days a log file is kept before deletion. OWASP says logs "must not be destroyed before the duration of the required data retention period, and must not be kept beyond this time".; Logs that help after a breach
Role: In Kubernetes RBAC, a list of verbs allowed on resources in one namespace. A RoleBinding gives a Role to a user or a ServiceAccount.; Least privilege
Rotation: Issuing a new secret, moving every program to it, then disabling the old one. After that, the leaked copy is refused wherever it ends up.; Secrets in git
Rotation: Replacing a secret with a new one and revoking the old one, so that a stolen copy stops working.; When you are breached
SafeLoader: The PyYAML loader used by yaml.safe_load. It has constructors for 12 standard tags (strings, numbers, lists, maps and a few more) and refuses every other tag.; Unsafe deserialization
Salt: A random string stored next to each user's hash and mixed into the input. Two users with the same password get different hashes. Django's salts are 22 characters, at least 128 bits.; Storing passwords
Same-site: Two URLs are same-site when they share a scheme and a registrable domain, such as app.example.com and blog.example.com. The port does not count.; Cross-site request forgery
SameSite: A Set-Cookie attribute that controls whether the browser sends the cookie on cross-site requests: Strict, Lax or None.; Sessions and cookies
SameSite: A cookie attribute (Strict, Lax or None) that tells the browser whether to attach the cookie to a request that comes from another site.; Cross-site request forgery
Schema: A declaration of the fields, types and length limits a request may carry, such as a zod z.strictObject({ ... }). Parsing the body against it returns a typed value or an error.; Validating input at the boundary
Secret: A string that grants access on its own, with no other check: an AWS access key, an API token, an SSH private key.; Secrets in git
Secret manager: A service (HashiCorp Vault, AWS Secrets Manager, Google Secret Manager) that stores secrets, hands them to authorized callers and can log each read.; Where secrets live
Secure default: A setting whose value out of the box is the safe one, so a person who never changes it stays protected. Redis's protected-mode yes is one.; Secure defaults
Secure default: A setting whose value without any configuration is the safe one. Saleor’s HTTP_IP_FILTER_ENABLED is True unless you turn it off (day 7).; Capstone: securing a small shop
Session fixation: An attack where the attacker picks the session id before the victim logs in, then reuses it after. It works when the server keeps the same id across login.; Sessions and cookies
Session id: A random value in a cookie that points to a record on the server. express-session names it connect.sid and makes it from 24 random bytes (192 bits); OWASP asks for at least 64 bits of entropy.; Sessions and cookies
Signer identity: The pair that cosign verify checks in the certificate: the subject (an email or a workflow URL) and the OIDC issuer that vouched for it.; Signing what you ship
SLSA Build level: A rung from L0 (no guarantee) to L3 (hardened build platform) in the SLSA spec. Each level adds requirements on the provenance and the build platform.; Supply chain attacks
SQL injection: User input is glued into the text of an SQL statement, so characters like ' or -- in that input change what the statement does.; SQL injection
SSRF: Server-side request forgery: the attacker gives the server a URL, and the server sends the request from inside its own network.; Server-side request forgery
Stored XSS: The script is saved on the server, in a comment or a profile field, and sent to every visitor who opens the page that shows it.; Cross-site scripting
strict-dynamic: A script-src keyword: a script allowed by a nonce or a hash may load more scripts, and those are allowed too.; Content Security Policy
STRIDE: Six prompts, one per letter: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. You ask each one of every box and arrow in the diagram.; Threat modeling a feature
Syscall: A request from a process to the kernel: openat opens a file, execve starts a program. Falco reads these events from the kernel and checks each one against its rules.; Detecting an attack
Tag: A YAML marker such as !!python/object/apply: that tells the loader which constructor builds the next value. The loader decides which tags it has a constructor for.; Unsafe deserialization
Threat model: A written answer to four questions about one system: what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job.; Threat modeling a feature
Threat model: A written list of what can go wrong with a feature, who would do it, and which control stops it (day 1).; Capstone: securing a small shop
Time step: The counter TOTP feeds to the HMAC: T = floor(unix_time / 30). At Unix time 59, T is 1. At 60, T is 2.; Second factors
TOTP: Time-based one-time password (RFC 6238): an HMAC of the current 30-second time step, keyed with a secret that the phone app and the server share, cut down to 6 digits.; Second factors
Transitive dependency: A package you did not list in package.json that one of your dependencies pulls in. npm explain semver prints the chain that installed each copy.; Responding to an advisory
Transitive dependency: A package you did not list yourself but that one of your dependencies (or theirs) pulls in. It appears in your lockfile, not in package.json or go.mod require lines you wrote.; Vulnerable dependencies
Trust boundary: A line in the data flow where data moves from a component you do not control (a browser, another company, the internet) to one you do (your proxy, your app, your database).; Trust boundaries
Trust boundary: A line where data passes from a party you do not control to one you do, like the browser to the API. Every check sits on that line (day 2).; Capstone: securing a small shop
Typosquatting: Publishing a package under a name close to a popular one, such as crossenv for cross-env, so that a typo installs it.; Pinning what you install
Untrusted data: Anything that crossed a trust boundary without a check: the URL, every header, every cookie and the body of an HTTP request.; Trust boundaries
Web root: A folder the web server serves as is under a URL. In Flask it is static/, served at /static/.; File uploads
WebAuthn: The browser API (navigator.credentials.get()) through which a security key or passkey signs a server’s random challenge with a private key it never reveals.; Second factors
Work factor: How much computing one hash costs: 1,800,000 iterations of PBKDF2-SHA256 in Django at the pinned commit. Every guess by an attacker pays the same cost.; Storing passwords