| Duplicate | Indicates that a security issue duplicates a previously recorded issue |
| IS | Information security |
| AI | Artificial intelligence |
| Integration | Data exchange between systems with possible subsequent processing |
| Software | Software |
| Security rule (SR) | A rule applied to a project's security issues |
| Security issue | A detected vulnerability or other security defect recorded based on scan results or entered manually |
| Security check | An entity that combines a scanning tool and scanning source; used to start scans and retrieve results |
| Project | An entity created by an authorized user to logically combine a set of related applications or components developed and maintained by one team or organization and assessed for compliance with the company's security policies and quality requirements |
| AD (Active Directory) | Directory services are collections of software services and databases based on Microsoft technologies that provide a hierarchical representation of information resources on a network and configure access to them |
| API (Application Programming Interface) | A software interface for interaction between systems |
| ASOC (Application Security Orchestration and Correlation) | Platforms or solutions for application security orchestration and correlation. These platforms manage and coordinate application security and automate the detection, analysis, and response processes for application-related security threats |
| AST (Application Security Testing) | Application security testing |
| CI/CD (Continuous Integration and Continuous Delivery/Deployment) | Continuous integration and continuous software delivery |
| CLI (Command Line Interface) | Command-line interface |
| Container Security | An approach to protecting and securely configuring containerization systems. The term covers a set of tools and methods for protecting containers from potential threats and attacks |
| CVE (Common Vulnerabilities and Exposures) | A publicly available registry of known software vulnerabilities with unique identifiers |
| CVSS (Common Vulnerability Scoring System) | A standardized system for rating vulnerability severity on a scale from 0 to 10 |
| CWE (Common Weakness Enumeration) | A classification system for errors in software code or architecture that lead to vulnerabilities |
| DAST (Dynamic Application Security Testing) | Dynamic code analysis is software analysis performed without access to the source code by executing the software. This application testing process simulates malicious external attacks that attempt to exploit common vulnerabilities |
| DevSecOps (Development Security Operations) | A secure development methodology that integrates security practices (Sec) into software development and delivery processes (DevOps) |
| EULA (End User License Agreement) | End-user license agreement |
| False positive (FP) | Indicates that a security issue was incorrectly identified by a tool as a real threat |
| GRC (Governance, Risk and Compliance) | Governance, risk, and compliance |
| IaC (Infrastructure-as-Code) | An approach to creating and managing infrastructure by using code, such as configuration files or scripts |
| LDAP (Lightweight Directory Access Protocol) | Lightweight Directory Access Protocol |
| MCP (Model Context Protocol) | A protocol for connecting AI agents to external systems and data |
| MTTD (Mean Time to Detect) | Mean time to detect a defect |
| MTTR (Mean Time to Recovery) | Mean time to resolve a defect |
| OSA (Open Source Analysis) | Analysis of open-source software libraries and components that fall within the scope of software development and are already used as application artifacts. The analysis identifies known security vulnerabilities and license violations |
| PURL (Package URL) | A standardized format for identifying a software package and its version |
| Quality Gate (Quality control) | A checkpoint that defines the criteria for passing a scan quality check |
| RBAC (Role-Based Access Control) | A user role-based access control model |
| SARIF (Static Analysis Results Interchange Format) | A standardized format for exchanging static analysis results between tools |
| SAST (Static Application Security Testing) | An application testing process that uses static analysis to detect errors and vulnerabilities in source code. Static analysis can identify code that may contain vulnerabilities |
| SBOM (Software Bill of Materials) | A software composition specification that lists all application components, libraries, and dependencies |
| SCA (Software Composition Analysis) | Software composition analysis identifies the components in software to detect and manage open-source components and their vulnerabilities |
| SIEM (Security Information and Event Management) | A class of systems for collecting, correlating, and analyzing security events |
| SSO (Single Sign-On) | A single sign-on technology that authenticates users with one account across multiple services |
| VEX (Vulnerability Exploitability eXchange) | A document format that describes the exploitability status of vulnerabilities found in SBOM components |