| Duplicate | Indicates that a security issue repeats a previously recorded issue |
| IS | Information security |
| AI | Artificial intelligence |
| Integration | Exchange of data between systems, with possible subsequent processing |
| Software | Software |
| Security rule (SR) | A rule applied to a project's security issues |
| Security issue | A detected vulnerability or other security defect recorded based on scan results or entered manually |
| Security check | An entity that combines a scanning tool and scan source; used to start scans and obtain results |
| Project | An entity created by an authorized user to logically combine a set of related applications or components developed and maintained by one team or organization. The project must be checked for compliance with the company's security policies and quality requirements. |
| AD (Active Directory) | Directory services are collections of software services and databases based on Microsoft technology that provide a hierarchical representation of network resources and configure access to them. |
| API (Application Programming Interface) | A software interface for interaction between systems |
| ASOC (Application Security Orchestration and Correlation) | Platforms or solutions for application security orchestration and correlation. These platforms manage and coordinate application security and automate the detection, analysis, and response to application-related security threats. |
| AST (Application Security Testing) | Application security testing |
| CI/CD (Continuous Integration and Continuous Delivery/Deployment) | Continuous software integration and delivery |
| CLI (Command Line Interface) | Command-line interface |
| Container security | An approach to protecting and securely configuring containerization systems. It covers a set of tools and methods for protecting containers from potential threats and attacks. |
| CVE (Common Vulnerabilities and Exposures) | A publicly available registry of known software vulnerabilities with unique identifiers |
| CVSS (Common Vulnerability Scoring System) | A standardized system for rating vulnerability severity on a scale from 0 to 10 |
| CWE (Common Weakness Enumeration) | A classifier of errors in software code or architecture that lead to vulnerabilities |
| DAST (Dynamic Application Security Testing) | Dynamic code analysis analyzes software without access to its source code by executing the software. This application testing process simulates malicious external attacks that attempt to exploit common vulnerabilities. |
| DevSecOps (Development Security Operations) | A secure development methodology that integrates security practices (Sec) into software development and delivery processes (DevOps). |
| EULA (End User License Agreement) | End-user license agreement |
| False positive (FP) | Indicates that a security issue was incorrectly identified by a tool as a real threat |
| GRC (Governance, Risk and Compliance) | Governance, risk, and compliance |
| IaC (Infrastructure-as-Code) | An approach to creating and managing infrastructure through code, such as configuration files or scripts |
| LDAP (Lightweight Directory Access Protocol) | Lightweight Directory Access Protocol |
| MCP (Model Context Protocol) | A protocol for connecting AI agents to external systems and data |
| MTTD (Mean Time to Detect) | Mean time to detect a defect |
| MTTR (Mean Time to Recovery) | Mean time to resolve a defect |
| OSA (Open Source Analysis) | The analysis of open-source libraries and components that fall within the scope of software development or are already used as artifacts in an application. The analysis identifies known security vulnerabilities and license violations. |
| PURL (Package URL) | A standardized format for identifying a software package and its version |
| Quality gate (Quality control) | A checkpoint that defines the criteria for passing a scan quality check |
| RBAC (Role-Based Access Control) | A user role-based access control model |
| SARIF (Static Analysis Results Interchange Format) | A standardized format for exchanging static analysis results between tools |
| SAST (Static Application Security Testing) | A process for testing an application for errors and vulnerabilities in its source code through static analysis. Static analysis can help find code that may contain vulnerabilities. |
| SBOM (Software Bill of Materials) | A software composition specification that lists all application components, libraries, and dependencies |
| SCA (Software Composition Analysis) | Software composition analysis identifies the components that make up software to detect and manage open-source components and their vulnerabilities. |
| SIEM (Security Information and Event Management) | A class of systems for collecting, correlating, and analyzing security events |
| SSO (Single Sign-On) | A single sign-on technology that authenticates users with one account across multiple services |
| VEX (Vulnerability Exploitability eXchange) | A document format that describes the exploitability status of vulnerabilities found in SBOM components |