Software quality & security glossary

SAST analyses source code, bytecode, or binaries for security flaws without running the program — catching vulnerabilities like injection, h…

DAST tests a running application from the outside — sending real requests to find vulnerabilities that only appear at runtime, like broken a…

SCA inventories the third-party and open-source dependencies in a project and flags known vulnerabilities, license risks, and unmaintained p…

SARIF is an OASIS-standard JSON format for static-analysis results. It lets any scanner report findings — with file, line, rule id, and seve…

A quality gate is an automated pass/fail checkpoint in a pipeline that blocks code from merging or deploying unless it meets defined thresho…

Mutation testing measures how good your tests actually are by introducing small bugs (mutants) into the code and checking whether the test s…

The false positive rate is the share of a scanner's findings that aren't real problems. It's the single biggest factor in whether a security…

Supply-chain security protects everything your software depends on but doesn't write — open-source packages, build tools, CI pipelines, and …

An SBOM is a machine-readable inventory of every component in a piece of software — each dependency, its version, and its license. It's what…

Secret scanning detects credentials — API keys, tokens, private keys, passwords — accidentally committed to source code, so they can be revo…

Shift left means moving testing and security earlier in the development lifecycle — into the editor, the commit, and the pull request — inst…

Technical debt is the implied future cost of choosing a fast or easy solution now instead of a better one that would take longer. Like finan…