Security words, in plain English.

Access controlThe rules deciding which person can see or do which thing in your app. Account takeoverAn attacker ends up signed in as one of your real users. AllowlistA list of what you permit, with everything else refused by default. APIThe part of your application other software talks to, not a person. Application securityKeeping the software you build and run from being abused. Attack surfaceEverything about your application an outsider can touch. Audit logA record of who did what and when, kept so you can answer later. AuthenticationProving you are who you say you are. It answers one question only. AuthorizationDeciding what a proven user is then allowed to do. Black-box testingTesting an app from outside, with no access to the source code. BOLAAn API returns a record just because you asked for it by number. Broken access controlAn application failing to enforce its own rules about who may do what. Brute forceTrying passwords or codes over and over until one of them works. Bug bountyPaying outside researchers for vulnerabilities they report responsibly. Business logic flawNothing is technically broken, but your own rules turn against you. CI/CDThe pipeline that builds, tests and ships code on every merge. ClickjackingTricking someone into clicking your button while it is hidden from them. Content Security PolicyA header telling the browser which scripts a page may load. CORSThe browser rule for which sites may read responses from your API. Credential stuffingTrying passwords leaked elsewhere, because people reuse them. CSRFAn attacker's page makes a logged-in user's browser act on your site. CVEA public reference number for one known flaw in one piece of software. CVSSA scoring system that turns a vulnerability into a number out of ten. CWEA catalogue of vulnerability types, rather than individual bugs. DASTTools that attack a running application from the outside. Data breachInformation you hold ends up somewhere it should not be. Defence in depthAssume any one control will fail, and have something else behind it. Denial of serviceMaking an application unavailable by overwhelming or exhausting it. Dependency vulnerabilityA known flaw in a library your application ships. Encryption at restStored data scrambled so a stolen disk is useless without the key. Encryption in transitProtecting data while it travels between a browser and your servers. EnumerationWorking out what exists by asking repeatedly and watching the answers. ExploitThe specific sequence that turns a suspected weakness into a real one. False negativeA real vulnerability that a test failed to find. False positiveA reported issue that turns out not to be real. FirewallA control deciding which traffic is allowed to reach a system. FuzzingThrowing malformed input at an application to see what falls over. Gating a buildStopping a release automatically when a security check fails. GraphQLOne API endpoint where the client asks for exactly the fields it wants. Hardcoded secretA password, API key or token written straight into source code. HashingA one-way transformation, so a password can be checked but never read back. Horizontal privilege escalationReaching another user's data at your own level, not a higher one. HTTPSThe encrypted web protocol, and the minimum for anything with a login. IASTAn agent inside a running app that watches where input travels. IDORChanging an id in a request and getting back someone else's record. Incident responseThe agreed plan for the hours after something has gone wrong. InjectionInput that ends up running as a command instead of being read as text. Input validationChecking that what arrives is the shape and range you expected. Insecure deserialisationTurning data from outside back into live objects without checking it. JWTA signed token a client carries to prove who is signed in. Key rotationReplacing a credential on a schedule so a leaked one has a short life. Known-vulnerable componentA library or runtime with a published flaw that you are still shipping. Lateral movementMoving from the first thing reached to the things worth taking. Least privilegeGiving every person and service the minimum access the job requires. Logging and monitoringRecording what happens, and actually watching what gets recorded. Mass assignmentWhen the fields in a request get written straight onto a record. MFAA second proof beyond the password, usually a code or a hardware key. MitigationReducing what a vulnerability can do without actually fixing it. Need to knowLimiting information to the people whose work actually requires it. NonceA value issued for a single use, so it cannot be replayed later. OAuthThe standard behind every sign in with and connect your account button. On-premisesSoftware running on hardware you own or control, not a vendor's. Open redirectA page that forwards visitors to any address handed to it in the URL. OWASP Top 10A widely used list of the ten most critical web application risks. PatchingApplying the fixes that vendors and maintainers publish. Path traversalUsing a crafted file name to reach files outside the intended folder. Penetration testA time-boxed engagement where skilled people attack your systems by hand. PhishingPersuading someone to hand over credentials by posing as a trusted sender. PIIAny data that points at a specific human being. Privilege escalationGaining rights you were never given, sideways or upwards. Proof of conceptThe smallest demonstration that a vulnerability is genuinely real. Quantum-safe cryptographyEncryption designed to stay secure against future quantum computers. Race conditionTwo near-simultaneous actions producing a result neither should allow. Rate limitingCapping how often something can be attempted, per user or per address. RBACPermissions attach to roles, and people are given roles. Red teamA simulated adversary given a goal and left to reach it however they can. RegressionA bug that was fixed and has come back, usually undone by a later change. RemediationThe actual work of fixing a finding: the change, the review, the release. Remote code executionGetting a server to run commands of an attacker's choosing. Risk acceptanceDeciding, on the record, to live with a known issue rather than fix it. SASTTools that read your source code without ever running it. SBOMA list of every component your application includes, with versions. SCAChecking your libraries against databases of published vulnerabilities. Secrets managementKeeping keys, passwords and tokens out of code and in a vault. Security questionnaireThe list of questions a buyer's security team sends before they sign. Session fixationAn attacker sets your session id before login, then waits for it to work. Session hijackingStealing the token that tells your application a browser is logged in. SeverityHow bad a finding is, from critical down to informational. Shift leftDoing security work while code is written, not as a check at the end. Single sign-onOne company identity for many applications, granted and removed in one place. SQL injectionInput a database ends up running as part of a query. SSRFMaking your server fetch a URL of the attacker's choosing. Supply chain attackReaching you through a library, a build tool or a vendor you trust. Tenant isolationWhat keeps one customer's data unreachable from another's session. Threat actorWhoever might attack you, described by capability and motive. Threat modelAsking what is worth taking, who wants it, and how they would try. TokenA string that stands in for an identity or a permission. TOTPThe six-digit code from an authenticator app, changing every thirty seconds. Unauthenticated accessAnything your application answers without signing in at all. Untrusted inputAnything that arrived from outside your own code, and is therefore suspect. Vertical privilege escalationClimbing to a higher level of access than your account was granted. VulnerabilityA weakness that somebody could use to cause harm. Vulnerability disclosureTelling an organisation about a flaw, and the policy that makes it safe. Vulnerability managementThe loop of finding, prioritising, fixing and checking the fix held. WAFA filter in front of your application that blocks known bad requests. WebhookA URL you hand to another service so it can call you when something happens. White-box testingTesting with access to the source code, not just the running application. XSSAn attacker's script running in your pages, in your customers' sessions. XXEAn XML parser tricked into fetching files or internal addresses. Zero dayA vulnerability exploited before any fix exists. Zero trustAssuming the network proves nothing, and checking every request.