Skip to main content

Glossary

SAST & security glossary

Definitions of every term used across this site. Linked to the standard or rule they reference, so you can verify and follow up.

Air-gapped CSP CSRF CVE CWE DAST F1 Score HIPAA IAST Insecure Deserialization ISO/IEC 27001 NIS2 NIST CSF 2.0 OWASP ASVS OWASP Top 10 PCI-DSS Precision Prototype Pollution Recall SARIF SAST SBOM SOC 2 SQL Injection SSRF Taint analysis XSS XXE

Air-gapped

A computing environment physically and logically isolated from external networks (no internet, no DNS, no removable media). Required for classified-data environments (SCIF, zone restreinte) and many defense/critical-infra deployments.

→ /for-regulated-industries.php

CSP

Content Security Policy — HTTP response header that tells the browser which sources of script, style, image, etc. are allowed. Mitigates XSS by blocking inline scripts and unauthorised CDNs.

CSRF

Cross-Site Request Forgery — attack where an authenticated victim is tricked into submitting a request the attacker chose, abusing the victim's session cookie. Mitigated by anti-CSRF tokens or SameSite cookies. CWE-352.

CVE

Common Vulnerabilities and Exposures — a unique identifier for a publicly disclosed vulnerability (e.g., CVE-2021-44228 = log4shell). Used to track which version of a library is affected.

CWE

Common Weakness Enumeration — a community-developed list of software weaknesses (e.g., CWE-89 « SQL Injection ») maintained by MITRE. Every StaticCodeAudit rule is tagged with at least one CWE identifier.

→ /standards.php

DAST

Dynamic Application Security Testing — analysing a running application from the outside (HTTP requests, login flows). Complementary to SAST. Cannot find issues in unreachable code paths.

F1 Score

The harmonic mean of precision and recall — a single number summarising the trade-off between the two (2 × P × R / (P + R)). Convenient for quick comparison, but it hides which of the two is actually driving the score, which is why detailed benchmarks report precision and recall separately too.

→ /language-benchmarks.php

HIPAA

US Health Insurance Portability and Accountability Act. The Security Rule (45 CFR §164.302–318) requires technical safeguards on electronic protected health information (ePHI), including access controls, audit logs, and integrity verification.

IAST

Interactive Application Security Testing — combines SAST and DAST by instrumenting the application at runtime. Requires an agent in the app's process, which limits offline use.

Insecure Deserialization

Deserialising attacker-controlled bytes (pickle, Java ObjectInputStream, PHP unserialize, .NET BinaryFormatter) leads to arbitrary code execution via gadget chains. CWE-502.

ISO/IEC 27001

International standard for information security management systems. Annex A lists 93 controls (2022 revision). Certification proves an organisation has implemented and operates an ISMS.

→ /standards.php

NIS2

EU directive 2022/2555 on cybersecurity for « essential » and « important » entities (energy, banks, healthcare, digital infra, etc.). Article 21 mandates risk management measures including supply chain security and SBOM evidence.

→ /for-regulated-industries.php

NIST CSF 2.0

NIST Cybersecurity Framework, version 2.0 (2024). Five functions: Identify, Protect, Detect, Respond, Recover. Widely adopted by US federal agencies and critical infrastructure operators.

→ /standards.php

OWASP ASVS

Application Security Verification Standard — OWASP's checklist of 280+ verification requirements grouped into 14 chapters. Levels 1 (basic) / 2 (standard) / 3 (advanced). Current version: 5.0.0.

→ /standards.php

OWASP Top 10

Owasp's regularly updated list of the 10 most critical web application security risks (last update: 2021). Includes A01 Broken Access Control, A03 Injection, A07 Identification & Authentication Failures, etc.

→ /standards.php

PCI-DSS

Payment Card Industry Data Security Standard. Required by Visa/MC/Amex for any merchant or processor handling payment card data. Version 4.0 (2024) §6.2 requires secure development practices including code review.

Precision

Of all the alerts a scanner raises, the share that are real vulnerabilities (TP / (TP + FP)). Low precision means lots of false positives to sort through — a scanner with 74% precision means roughly 1 in 4 alerts is noise.

→ /language-benchmarks.php

Prototype Pollution

JavaScript-specific vulnerability where attacker can pollute Object.prototype via crafted keys (__proto__, constructor). Affects every downstream object. CWE-1321.

→ /javascript-sast.php

Recall

Of all the real vulnerabilities that exist, the share a scanner actually finds (TP / (TP + FN)). Low recall means real vulnerabilities are being missed — the more dangerous failure mode for a security tool, since a missed flaw ships to production.

→ /language-benchmarks.php

SARIF

Static Analysis Results Interchange Format — OASIS standard (v2.1.0) JSON format for tool-agnostic SAST output. Ingested by GitHub Code Scanning, GitLab Security Dashboard, ServiceNow, RSA Archer, etc.

SAST

Static Application Security Testing — analysing source code (or compiled bytecode) without running it, to find security vulnerabilities. Opposite of DAST. StaticCodeAudit is a SAST tool.

→ /product.php

SBOM

Software Bill of Materials — a machine-readable inventory of every component (library, version, license) in a piece of software. Required by US Executive Order 14028 and EU NIS2 directive for software supply chain attestation. Common formats: CycloneDX, SPDX.

SOC 2

Service Organisation Control 2 — AICPA audit framework for service providers, covering 5 « Trust Service Criteria » (security, availability, processing integrity, confidentiality, privacy). Type II audits cover a period (typically 6-12 months).

SQL Injection

Vulnerability where user input is concatenated into an SQL query without parameter binding, letting an attacker alter the query logic (read other rows, drop tables, exfiltrate data). CWE-89.

→ /python-sast.php

SSRF

Server-Side Request Forgery — vulnerability where an attacker tricks a server into making HTTP requests to internal services (cloud metadata endpoints, RDS, internal microservices) the attacker can't reach directly. CWE-918.

Taint analysis

Tracking how untrusted user input (« source ») flows through code until it reaches a dangerous function (« sink ») without going through a sanitiser. The technique behind detection of SQL injection, XSS, SSRF, command injection.

XSS

Cross-Site Scripting — vulnerability where attacker-controlled input is reflected in HTML without escaping, letting the attacker execute JavaScript in the victim's browser. Variants: stored, reflected, DOM-based.

→ /javascript-sast.php

XXE

XML External Entity — vulnerability in XML parsers that resolve external entities (DTD references). Lets attackers read local files, perform SSRF, or trigger denial of service (billion laughs). CWE-611.

→ /java-sast.php

Authoritative sources

Every definition in this glossary is derived from a publicly maintained specification. Verify directly: