Security Glossary: 38+ Terms

Updated 2026-02-05

A comprehensive cybersecurity glossary explaining 38+ security terms, vulnerabilities, and attacks in plain English. Perfect for developers and SaaS founders building secure applications.

A

API Key: A unique identifier used to authenticate requests to an API. API keys should be kept secret and never exposed in client-side code or public repositories.
Authentication: The process of verifying the identity of a user, device, or system. Common methods include passwords, multi-factor authentication (MFA), and OAuth.
Authorization: The process of determining what actions an authenticated user is allowed to perform. Often confused with authentication, but they serve different purposes.

B

Broken Access Control: A vulnerability where users can access resources or perform actions beyond their intended permissions. Consistently ranks as the #1 web application security risk in OWASP Top 10.
Brute Force Attack: An attack method that involves systematically trying all possible combinations of passwords or keys until the correct one is found. Rate limiting and account lockouts help prevent these attacks.

C

CORS: Cross-Origin Resource Sharing. A security mechanism that allows or restricts web applications from making requests to domains other than their own. Misconfigured CORS can lead to data theft.
CSRF: Cross-Site Request Forgery. An attack that tricks authenticated users into performing unintended actions on a web application. Prevented using CSRF tokens and SameSite cookies.
CVE: Common Vulnerabilities and Exposures. A standardized identifier for known security vulnerabilities. Each CVE has a unique ID (e.g., CVE-2021-44228 for Log4Shell).

D

Data Breach: An incident where sensitive, protected, or confidential data is accessed, stolen, or used by an unauthorized party. Can result in regulatory fines and reputation damage.
DDoS: Distributed Denial of Service. An attack that overwhelms a system with traffic from multiple sources, making it unavailable to legitimate users.

E

Encryption: The process of converting data into a coded format that can only be read with the correct decryption key. Essential for protecting data at rest and in transit.

H

Hashing: A one-way function that converts data into a fixed-length string. Used for password storage (with algorithms like bcrypt or Argon2) and data integrity verification.
HTTPS: HTTP Secure. The encrypted version of HTTP using TLS. All modern web applications should use HTTPS to protect data in transit between client and server.

I

IDOR: Insecure Direct Object Reference. A vulnerability where an application exposes internal object references (like database IDs) that attackers can manipulate to access unauthorized data.
Injection: A class of vulnerabilities where untrusted data is sent to an interpreter as part of a command or query. Includes SQL injection, NoSQL injection, and command injection.
Input Validation: The process of ensuring that user-supplied data meets expected formats and constraints before processing. A critical defense against injection attacks.

J

JWT: JSON Web Token. A compact, URL-safe token format used for authentication and information exchange. Must be properly validated and stored securely.

M

MFA: Multi-Factor Authentication. A security method requiring two or more verification factors (something you know, have, or are) to access an account.

O

OAuth: An open standard for access delegation. Allows users to grant third-party applications limited access to their resources without sharing credentials.
OWASP: Open Web Application Security Project. A nonprofit organization that produces resources, tools, and documentation on web application security, including the famous OWASP Top 10.
OWASP Top 10: A regularly updated list of the ten most critical web application security risks. The current list includes Broken Access Control, Cryptographic Failures, and Injection.

P

Penetration Testing: An authorized simulated attack on a system to evaluate its security. Penetration testers (pentesters) attempt to exploit vulnerabilities to assess risk.
Privilege Escalation: An attack where a user gains elevated access to resources that are normally protected. Can be vertical (gaining higher privileges) or horizontal (accessing other users' data).

R

Rate Limiting: A technique to control the number of requests a user can make to an API or service within a time period. Essential for preventing brute force attacks and API abuse.
RBAC: Role-Based Access Control. A method of restricting system access based on the roles of individual users. Simplifies permission management in complex applications.

S

Same-Origin Policy: A browser security mechanism that restricts how documents or scripts from one origin can interact with resources from another origin.
Secret Management: The practice of securely storing, accessing, and managing sensitive credentials like API keys, passwords, and certificates. Tools include HashiCorp Vault and AWS Secrets Manager.
Security Audit: A comprehensive assessment of an application's security posture, including code review, architecture analysis, and vulnerability identification.
Session Management: The process of securely handling user sessions, including session creation, validation, and termination. Poor session management can lead to session hijacking.
SQL Injection: A code injection technique that exploits vulnerabilities in database queries. Attackers can read, modify, or delete database data. Prevented by using parameterized queries.
SSRF: Server-Side Request Forgery. A vulnerability where an attacker can make the server perform requests to unintended locations, potentially accessing internal resources.

T

TLS: Transport Layer Security. A cryptographic protocol that provides secure communication over networks. The successor to SSL and the backbone of HTTPS.

V

Vibe Coding: A development approach where programmers rely heavily on AI assistants to generate code without fully understanding what the code does. While fast, this often introduces security vulnerabilities.
Vulnerability: A weakness in a system that can be exploited by an attacker to perform unauthorized actions. Vulnerabilities are often rated by severity using CVSS scores.
Vulnerability Assessment: The process of identifying, quantifying, and prioritizing vulnerabilities in a system. Often uses automated scanning tools combined with manual review.

W

WAF: Web Application Firewall. A security solution that monitors and filters HTTP traffic between a web application and the internet, blocking common attacks like XSS and SQL injection.

X

XSS: Cross-Site Scripting. A vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. Types include stored, reflected, and DOM-based XSS.

Z

Zero-Day: A vulnerability that is unknown to the software vendor and has no available patch. Zero-day exploits are particularly dangerous because there's no defense against them initially.

Want to secure your application?

Understanding security terms is the first step. Let us audit your code and find vulnerabilities before attackers do.

View Security Audits