# Security glossary — geearr

## Attack surface

Every point where an attacker could try to get in or extract data: internet-facing hosts, APIs, login pages, third-party integrations, cloud accounts, email domains and the people who can be phished. Reducing and mapping it is the first step of any security assessment.

## Penetration test (pen test, pentest)

An authorized, time-boxed attack on a system by a human tester to find exploitable weaknesses and demonstrate their real-world impact. Unlike a scan, a pen test validates findings, chains them together and tests business logic.

## Vulnerability scan

An automated check that compares software versions and configurations against databases of known vulnerabilities. Fast and repeatable, but noisy and blind to logic flaws and chained attacks.

## Red team

A goal-based adversary simulation that tests an organization’s detection and response, not just its vulnerabilities — often combining technical exploitation, phishing and physical or social techniques over weeks.

## CVSS (Common Vulnerability Scoring System)

A standard (currently v4.0) for rating the severity of a vulnerability from 0.0 to 10.0 based on how it is exploited and what it affects. Useful for consistency, but context — what data and systems are reachable — decides real priority.

## CVE (Common Vulnerabilities and Exposures)

A public identifier (for example CVE-2024-3094) assigned to a specific known vulnerability in a specific product, so vendors, scanners and defenders can refer to the same issue.

## BOLA / IDOR (Broken Object Level Authorization, Insecure Direct Object Reference)

An access-control flaw where an application returns or modifies a record based on an ID supplied by the user without checking that the user is allowed to access it — for example changing /invoices/1001 to /invoices/1002. The #1 risk in the OWASP API Security Top 10.

## SSRF (Server-Side Request Forgery)

A flaw that lets an attacker make the server send requests to destinations of their choosing — often internal services or cloud metadata endpoints that expose credentials.

## XSS (Cross-Site Scripting)

Injection of attacker-controlled script into pages viewed by other users, allowing session theft or actions on the victim’s behalf. Prevented by context-aware output encoding and a strict Content Security Policy.

## CSRF (Cross-Site Request Forgery)

An attack that tricks a logged-in user’s browser into sending an unwanted state-changing request to a site that trusts it. Mitigated with SameSite cookies, anti-CSRF tokens and checking the request origin.

## SQL injection

Inserting attacker-controlled input into a database query so it changes the query’s meaning — reading, altering or deleting data. Prevented by parameterized queries, never string concatenation.

## Threat modeling

A structured design review that maps how data flows through a system, where trust boundaries are, and what could go wrong at each one — so security issues are fixed in design instead of found in production.

## STRIDE

A threat-modeling mnemonic for six threat classes: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege.

## SAST (Static Application Security Testing)

Automated analysis of source code for insecure patterns without running it. Best run on every pull request; strongest when tuned to a codebase’s frameworks.

## DAST (Dynamic Application Security Testing)

Automated testing of a running application from the outside by sending crafted requests and observing responses. Finds runtime and configuration issues SAST cannot see.

## SCA (Software Composition Analysis)

Identifying the open-source dependencies an application uses and flagging known vulnerabilities and license issues in them.

## SBOM (Software Bill of Materials)

A machine-readable inventory (SPDX or CycloneDX) of every component in a piece of software, used to answer “are we affected?” the moment a new vulnerability is disclosed.

## Secrets scanning

Detecting API keys, passwords, tokens and private keys committed to source code, build logs, container images or front-end bundles — ideally blocking them before they are pushed.

## SPF (Sender Policy Framework)

A DNS TXT record listing the servers allowed to send email for a domain (RFC 7208). It is limited to 10 DNS lookups and checks the envelope sender, not the From: address people see.

## DKIM (DomainKeys Identified Mail)

A cryptographic signature added to each outgoing email, verified with a public key published in DNS (RFC 6376). It proves the message was authorized by the signing domain and not altered in transit.

## DMARC (Domain-based Message Authentication, Reporting and Conformance)

A DNS policy (RFC 7489) that requires SPF or DKIM to pass and align with the visible From: domain, tells receivers what to do with failures — p=none, p=quarantine or p=reject — and sends reports on who is sending as the domain.

## BIMI (Brand Indicators for Message Identification)

A standard that displays a verified brand logo next to authenticated email in supporting inboxes. Requires DMARC at enforcement and usually a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).

## MTA-STS (SMTP MTA Strict Transport Security)

A policy (RFC 8461) that tells sending mail servers to require valid TLS when delivering to a domain, preventing downgrade and interception of mail in transit. Paired with TLS-RPT for failure reports.

## Email spoofing

Forging the From: address so a message appears to come from a trusted domain. Exact-domain spoofing is stopped by DMARC at p=reject; lookalike domains require monitoring and user verification.

## BEC (Business Email Compromise)

Fraud in which attackers impersonate or take over an executive, employee or vendor mailbox to redirect payments or extract data. It often involves no malware at all, so controls must cover process — like verifying bank changes out of band — not just technology.

## Phishing

Deceptive messages — email, SMS, voice or chat — designed to trick people into revealing credentials, approving MFA prompts, paying fraudulent invoices or running malware.

## OAuth 2.0

An authorization framework that lets an application obtain limited, scoped access to an API on a user’s behalf via access tokens, without handling the user’s password. Current best practice is defined in RFC 9700.

## OpenID Connect (OIDC)

An identity layer on top of OAuth 2.0 that adds a signed ID token describing who the user is, plus standard discovery and user-info endpoints. It is what “Sign in with…” buttons use.

## PKCE (Proof Key for Code Exchange)

An OAuth extension (RFC 7636) where the client proves it started the login by presenting a secret verifier when redeeming the authorization code. Required for public clients and recommended for all clients.

## JWT (JSON Web Token)

A compact, signed (and optionally encrypted) token carrying claims such as user ID, audience and expiry. Must be validated strictly: allowed algorithms, signature, issuer, audience and expiration.

## Passkeys

Phishing-resistant, passwordless credentials based on WebAuthn/FIDO2 public-key cryptography. The private key never leaves the user’s device or password manager, so there is nothing reusable to steal.

## Least privilege

Granting every user, service and workload only the permissions it needs, for only as long as it needs them. The single most effective way to limit how far an attacker gets after initial access.

## IAM privilege escalation

Abusing a cloud permission that seems harmless — such as iam:PassRole or the ability to edit a function — to gain broader access, often up to full administrator.

## Zero Trust

A security model that grants access per request based on verified identity, device posture and context, instead of trusting anything inside a network perimeter or VPN.

## CSPM (Cloud Security Posture Management)

Tooling that continuously checks cloud configuration against benchmarks such as CIS. Useful for coverage, but needs attack-path context to prioritize what actually matters.

## Row-level security (RLS)

Database policies that restrict which rows each user can read or write. In Supabase and similar backends the browser talks to the database directly, so a table without RLS is readable by anyone with the public key.

## Vibe coding

Building software mostly by prompting AI coding tools (Cursor, Claude, Lovable, Bolt, v0) and accepting what works. Fast, but commonly ships missing authorization, exposed secrets and permissive database rules.

## Prompt injection

An attack in which untrusted content — a web page, document, email or tool output — contains instructions that a large language model follows as if they came from its user or developer. The top risk in the OWASP Top 10 for LLM Applications.

## MCP (Model Context Protocol)

An open protocol for connecting AI assistants and agents to tools and data sources. Every MCP server an agent can call is a permission boundary and must be scoped, authenticated and logged.

---
Canonical: https://geearr.com/glossary · Updated: 2026-10-12 · Site index for LLMs: https://geearr.com/llms.txt