● 89 entries
Application Security
- Abuse CaseA requirements artifact that describes how a malicious actor would deliberately try to misuse a system to harm users, data or the business.
- API SecurityThe discipline of designing, building and operating application programming interfaces so that authentication, authorization, data exposure and abuse-resistance hold up under attack.
- Application Security (AppSec)The discipline of designing, building, testing and operating software so it resists abuse, tampering and unauthorized access throughout its lifecycle.
- ASLRAddress Space Layout Randomization randomizes the memory locations of code, stacks, heaps, and libraries so attackers cannot reliably predict target addresses for exploits.
- Browser SandboxAn OS-level isolation layer that confines a browser's renderer and helper processes so that compromised web code cannot read the file system or other applications.
- CAPTCHAChallenge-response test designed to distinguish humans from automated bots, typically deployed on signup, login, and form-submission endpoints.
- Capture the Flag (CTF)A cybersecurity competition in which teams solve security challenges to retrieve hidden tokens, used for training, hiring, and community building.
- CI/CD SecurityThe set of controls protecting continuous integration and continuous delivery pipelines from compromise, code injection, secret leakage, and unauthorized deployments.
- Content Security Policy (CSP)An HTTP response header that tells the browser which sources of scripts, styles, frames and other content are allowed, limiting the impact of XSS and data-injection attacks.
- Control-Flow IntegrityControl-Flow Integrity (CFI) constrains a program's indirect calls and returns to a precomputed set of legitimate targets, blocking ROP and JOP exploits that hijack control flow.
- CORS (Cross-Origin Resource Sharing)A browser-enforced mechanism that lets a server selectively relax the Same-Origin Policy so that JavaScript on one origin can read responses from another.
- CosignAn open-source CLI from the Sigstore project for signing, verifying, and attesting to OCI artifacts and other software using either keyed or keyless workflows.
- Coverage-Guided FuzzingA fuzzing technique that instruments the target to measure code coverage and evolves inputs that explore previously unseen paths, dramatically improving bug-finding efficiency.
- Cross-Origin Embedder Policy (COEP)An HTTP response header that forces every cross-origin subresource a document loads to explicitly opt in via CORS or CORP, completing the cross-origin isolation prerequisites alongside COOP.
- Cross-Origin Opener Policy (COOP)An HTTP response header that lets a document opt into a process-isolated browsing context group, preventing cross-origin windows from inspecting or manipulating it via `window.opener` and friends.
- Cryptographic Bill of Materials (CBOM)An inventory that lists every cryptographic asset used by software or systems - algorithms, key lengths, certificates, libraries, and protocols - to support crypto agility and post-quantum readiness.
- CycloneDXAn OWASP-curated open standard for software, SaaS, ML, and crypto bills of materials, designed from the start for security use cases and now widely used to ship SBOMs alongside releases.
- DAST (Dynamic Application Security Testing)Black-box security testing that probes a running application over the network to find vulnerabilities visible only at runtime, such as injection, auth flaws and misconfigurations.
- DEPData Execution Prevention (also called NX or W^X) marks memory pages as non-executable so attackers cannot run shellcode injected into the stack or heap.
- Dependency Confusion AttackA supply-chain attack in which an adversary publishes a malicious package on a public registry with the same name as an organization's internal dependency, tricking build tools into pulling the public version.
- Dependency PinningThe practice of declaring software dependencies at exact versions, often combined with cryptographic hashes, so that builds always consume the same artifacts and resist supply-chain tampering.
- DevSecOpsA culture and set of practices that integrates security responsibilities into DevOps workflows so engineers ship secure software continuously and at speed.
- DOM ClobberingA browser-side technique in which attacker-controlled HTML elements with `id` or `name` attributes shadow global JavaScript variables, turning seemingly harmless markup into a vector for XSS, CSP bypass, and gadget chaining.
- ELF Binary FormatExecutable and Linkable Format, the standard binary container for executables, object files, and shared libraries on Linux, BSD, and most System V Unix derivatives.
- Fuzz TestingAn automated testing technique that feeds a program large amounts of malformed, random or unexpected input to uncover crashes, memory corruption and security vulnerabilities.
- GitOps SecuritySecurity practices for GitOps workflows, where the declarative desired state of infrastructure and applications is stored in Git and reconciled into production by an automated controller.
- Hardcoded Secrets in CodeEmbedding credentials, API keys, tokens, or cryptographic material directly in source code, configuration files, or container images, where they are easily discovered and abused.
- Headless BrowserA web browser that runs without a graphical user interface and is driven programmatically, commonly used for testing, scraping, and security automation.
- HTTP Security HeadersResponse headers that instruct browsers to enforce defensive behaviour such as HTTPS-only, framing restrictions, content policies and referrer controls.
- HttpOnly Cookie FlagA cookie attribute that hides the cookie from JavaScript by forbidding access via 'document.cookie', limiting session theft when XSS is exploited.
- IAST (Interactive Application Security Testing)Application security testing that instruments a running application from the inside to observe code execution while it is being exercised by traffic or tests.
- iframe sandboxHTML attribute that applies extra restrictions to an iframe's content, blocking scripts, forms, navigation, and same-origin access unless explicitly re-enabled.
- in-totoAn open framework that cryptographically attests to every step of a software supply chain so that consumers can verify the artifact was built and handled exactly as the project owner intended.
- Input ValidationThe server-side check that every untrusted input matches an expected type, length, range, format and value set before being processed by the application.
- Intel CETIntel CET (Control-flow Enforcement Technology) is a CPU feature combining a hardware shadow stack and Indirect Branch Tracking (IBT) to block ROP, JOP and COP exploits.
- JIT SprayAn exploit technique that abuses just-in-time compilers to plant attacker-chosen executable bytes inside legitimately generated, executable memory pages.
- JWT VulnerabilitiesClasses of implementation flaws in JSON Web Token validation that allow attackers to forge tokens, escalate privileges, or bypass authentication.
- KASLRKernel Address Space Layout Randomization (KASLR) randomizes the kernel base and module load addresses each boot so attackers cannot hardcode kernel symbols for local privilege escalation.
- Mach-OMach-O is the native executable, object, and shared library format used by macOS, iOS, watchOS, and tvOS for binaries built with Apple's toolchain.
- Malicious Browser ExtensionA browser add-on that abuses its host permissions to steal credentials, hijack sessions, inject ads, or exfiltrate user data, often through compromised updates of legitimate extensions.
- Memory SafetyMemory safety is the property that a program never reads, writes, or executes memory it has not legitimately allocated, preventing entire classes of vulnerabilities.
- Memory-Safe LanguagesMemory-safe languages such as Rust, Go, Swift, Java, and C# prevent the spatial and temporal memory errors that drive most exploitable vulnerabilities in C and C++.
- MIME SniffingBrowser behaviour of guessing a response's content type from its bytes, which can be exploited to execute uploaded files as scripts.
- Misuse CaseA negative use case describing interactions a system must prevent, drawn so that legitimate use cases and hostile misuse cases are analyzed together.
- Mixed ContentSituation where an HTTPS page loads subresources (scripts, styles, images, XHR) over plain HTTP, weakening the page's overall security guarantees.
- Mutation FuzzingA fuzz testing strategy that derives new test inputs by randomly mutating existing valid samples, such as flipping bits, inserting bytes or splicing files.
- Output EncodingTransforming untrusted data into a form that is safe for a specific output context — HTML, JavaScript, URL, SQL, shell — so it cannot break out and execute as code.
- Package SigningApplying a cryptographic signature to a software package so that consumers can verify the publisher's identity and that the artifact has not been altered after release.
- Parameterized QueryA database query whose values are sent separately from the SQL text via placeholders, so user input can never alter the query's structure.
- PDF ExploitA malicious PDF document that abuses parser bugs, embedded JavaScript, fonts, or external actions in a PDF reader to achieve code execution or data exfiltration.
- PE Executable FormatPortable Executable, the Windows binary file format used by .exe, .dll, .sys, and .ocx files and derived from the older COFF object format.
- Permissions-PolicyAn HTTP response header (formerly Feature-Policy) that lets a site declare which browser features — camera, microphone, geolocation, payment, USB, sensors — its own document and any embedded iframes are allowed to use.
- Playwright SecuritySecurity considerations for Playwright, Microsoft's cross-browser automation framework that drives Chromium, Firefox, and WebKit with isolated contexts.
- Provenance AttestationA signed, machine-verifiable statement that describes how a software artifact was produced - including source, build system, parameters, and dependencies - so consumers can trust its origin.
- Puppeteer SecuritySecurity considerations for Puppeteer, Google's Node.js library that drives Chrome and Chromium over the DevTools Protocol for automation and testing.
- RASP (Runtime Application Self-Protection)A defense embedded inside a running application that monitors execution context and blocks malicious behavior, such as injection or deserialization attacks, in real time.
- Referrer PolicyHTTP response header (or meta tag) that controls how much of the originating URL the browser shares in the Referer header on outgoing requests.
- Reproducible BuildsBuild practices that ensure compiling the same source code with the same instructions produces a bit-for-bit identical artifact, regardless of when or where it is built.
- Return-Oriented ProgrammingReturn-Oriented Programming (ROP) is a code-reuse exploit technique that chains short instruction sequences ending in RET to execute arbitrary computation without injecting new code.
- robots.txtA text file served at the site root that tells well-behaved web crawlers which paths they may or may not fetch, formalized in IETF RFC 9309.
- Rust Security PropertiesRust enforces memory and thread safety at compile time through ownership, borrowing, and lifetimes, eliminating common UB classes such as use-after-free and data races without a garbage collector.
- Same-Origin Policy (SOP)Browser security rule that restricts how a document or script loaded from one origin can interact with a resource from a different origin.
- SameSite CookieA cookie attribute that controls whether browsers attach the cookie on cross-site requests, with values Strict, Lax and None, used primarily to mitigate CSRF.
- SAST (Static Application Security Testing)Automated analysis of source code, bytecode or binaries — without executing it — to find security weaknesses such as injection, unsafe APIs or insecure crypto.
- SCA (Software Composition Analysis)Automated analysis of an application's open-source and third-party components to identify known vulnerabilities, license issues and outdated or risky dependencies.
- Secure CodingThe practice of writing source code in ways that minimize security defects, following defensive patterns, language-specific rules and recognized guidelines.
- Secure Cookie FlagA cookie attribute that tells the browser to send the cookie only over HTTPS, preventing exposure in cleartext on the network.
- Secure Software Development Lifecycle (SSDLC)A development lifecycle in which security activities are embedded into every phase, from requirements and design through coding, testing, release and operations.
- Security RequirementsExplicit, testable statements of what a system must and must not do to protect confidentiality, integrity, availability and privacy.
- Session FixationAn attack in which the adversary plants a known session identifier in the victim's browser before login, so it remains valid for the attacker after authentication.
- Shadow StackA shadow stack is a separate, protected stack that stores copies of return addresses so the CPU can detect tampering with the regular stack and block ROP attacks.
- Shift-Left SecurityThe practice of moving security activities earlier in the software lifecycle so vulnerabilities are found and fixed before code reaches production.
- SigstoreAn open-source Linux Foundation project that makes signing, verifying, and protecting software artifacts easy by combining short-lived keys, OIDC identities, and a transparency log.
- Site IsolationA Chromium security architecture that places documents from different sites into separate operating-system processes so a compromised renderer cannot read cross-site data.
- SLSA FrameworkSupply-chain Levels for Software Artifacts: a tiered set of requirements published by OpenSSF that progressively hardens how software is built, signed, and verified against supply-chain tampering.
- SMEP / SMAPSMEP and SMAP are CPU features that prevent the kernel from executing or accessing user-space pages, blocking common local privilege-escalation techniques.
- Software Bill of Materials (SBOM)A formal, machine-readable inventory of the components, libraries, and dependencies that make up a piece of software, along with their versions and relationships.
- Software Supply Chain SecurityThe discipline of protecting every link of the software production chain - source, dependencies, build, signing, distribution, and deployment - against tampering, malicious code, and integrity loss.
- SPDX (Software Package Data Exchange)A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs.
- Speculative Execution Side ChannelA microarchitectural vulnerability class where CPUs leak data through caches and predictors after executing instructions speculatively along paths that should not have run.
- Stack CanaryA stack canary is a secret value placed between a function's local buffers and its saved return address to detect stack buffer overflows before they hijack control flow.
- Subresource Integrity (SRI)A browser mechanism that verifies a cryptographic hash of a script or stylesheet loaded from a third party before executing it, preventing tampered files from running.
- Symbolic ExecutionA program analysis technique that executes code with symbolic inputs rather than concrete values, building path constraints solved by an SMT solver to find bugs.
- Threat ModelingA structured analysis that identifies the assets, threats, vulnerabilities and mitigations of a system so security can be designed in rather than bolted on.
- Trusted TypesBrowser API and CSP directive that prevents DOM-based XSS by requiring dangerous DOM sinks to receive typed, policy-vetted values instead of raw strings.
- Type Confusion VulnerabilityA memory-safety bug where code accesses an object using a type incompatible with its real allocation, often enabling arbitrary read, write, or code execution.
- User-Agent SpoofingForging the User-Agent header or related client hints so that a request appears to come from a different browser, device, or operating system than it actually does.
- VEX (Vulnerability Exploitability eXchange)A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'.
- WebAssembly SecurityThe security model of WebAssembly — capability-based sandbox, no ambient access to syscalls, structured control flow — plus the practical risks of memory-unsafe languages compiled to Wasm and untrusted Wasm running outside the browser.