Glossary
Security tooling assumes a vocabulary and rarely supplies it. Every term below has its own address, so one definition can be linked to from wherever the word appears.
Making only the requests an ordinary visitor's browser would make: fetching pages, reading response headers, resolving DNS, and inspecting published JavaScript. Nothing is sent that is designed to change the target's behaviour, which is why a passive scan can run without prior arrangement.
Requests a visitor would not send. They stay locked until domain ownership is proven with a DNS TXT record or a file served from the target — enforced in code, not stated in a policy and trusted.
Reading source code to find patterns that are dangerous regardless of whether they are reachable at runtime. It sees things a running application never reveals, and reports some things that turn out to be unreachable — which is why its findings carry a confidence level rather than a verdict.
Testing a running application from the outside. It confirms what is actually exploitable, but only where it can reach — an endpoint behind a login it does not hold is invisible to it.
Making a server fetch a URL of the attacker's choosing. It matters because the server is usually inside a network the attacker is not — reaching internal services, or the cloud metadata endpoint that hands out credentials.
SSRF where the response never comes back to the attacker, so nothing in the reply reveals that the fetch happened. Detected with a URL pointing at a collector you control: the arrival of a request is the evidence, and it can arrive minutes after the scan finished.
The list of components a build actually contains, with versions. It turns a disclosure from an investigation into a lookup, which is what matters on the day a widely-used package is the one disclosed. A repository scan generates one per scan.
A public identifier for one specific vulnerability, so two people discussing it can be sure they mean the same thing. A CVE identifier says nothing about severity or whether you are affected — those are separate judgements.
A 0–10 score describing how bad a vulnerability is if it is exploited. It deliberately says nothing about how likely exploitation is, which is why a 9.8 that nobody has ever attacked can outrank a 6.5 being used today.
The probability that a vulnerability will be exploited in the next thirty days, from 0 to 1. It answers the question CVSS does not, which is why dependency findings here show both: severity says how bad, EPSS says how likely.
A response header telling the browser which sources of script, style, and other content it may load. A well-formed one turns a cross-site scripting bug from an exploitable hole into a blocked request, and a permissive one — `unsafe-inline`, a wildcard host — quietly gives that back.
Everything an attacker can reach without credentials: domains, subdomains, endpoints, certificates, published dependencies. It grows on its own — a staging subdomain nobody retired is part of it — which is the reason it is worth watching continuously rather than auditing once.
Two or more findings that matter more together than apart — an exposed admin interface and a weak session cookie, for instance. Findings are correlated into paths within a scan and across scans, so what you read is how issues compound rather than a flat list.
How sure the scanner is that a finding is real, stated separately from how bad it would be. A finding can be critical and only potential at once: severe if true, and whether it is true is what you are being asked to judge.
A finding that was fixed and has come back. Monitoring tags every finding new, persisting, fixed, or regressed against the previous run, because a fix that silently reverted is worse than one that was never made — you believe it is done.
Getting a language model to treat untrusted text as an instruction. It is not a bug in the model: text is the model's only input, so a system that concatenates user content into a prompt has no mechanism to say which half it should obey.
Registering a package name that AI coding assistants hallucinate. The model invents a plausible dependency, somebody publishes it, and the next developer who accepts the suggestion installs an attacker's code. Repository scans flag dependencies that do not exist upstream.
An audit log where each entry hashes its own contents together with the previous entry's hash. Editing or deleting a past entry breaks the chain from that point forward. It does not prevent tampering — it makes tampering detectable, which is the achievable property.
Keep reading
Contact
Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.