Glossary

Code Audit Glossary

Plain language definitions of the terms you will meet in a code audit report. 12 terms, A to Z.

C

Code smell

A code smell is a surface pattern in code that suggests a deeper design problem: not a bug itself, but a reliable hint that one is nearby.

Cross-site request forgery (CSRF)

Cross-Site Request Forgery

CSRF tricks a logged-in user's browser into sending state-changing requests the user never intended. Tokens and SameSite cookies are the fix.

Cross-site scripting (XSS)

Cross-Site Scripting

XSS lets attackers run their own JavaScript in victims' browsers by injecting script through unescaped input. Output encoding is the core fix.

CVE

Common Vulnerabilities and Exposures

A CVE is a unique public identifier for a known security vulnerability, letting tools, vendors, and teams refer to the same flaw unambiguously.

Cyclomatic complexity

Cyclomatic complexity counts the independent paths through a function. Higher numbers mean more branches to understand, test, and get wrong.

D

DAST

Dynamic Application Security Testing

DAST tests a running application from the outside, probing it like an attacker to find vulnerabilities that only appear at runtime.

I

IDOR

Insecure Direct Object Reference

IDOR is an access control flaw where changing an ID in a request exposes someone else's data, because the server never checks ownership.

S

SAST

Static Application Security Testing

SAST is automated analysis of source code, bytecode, or binaries for security flaws without running the program, catching bugs before deployment.

Secret sprawl

Secret sprawl is the uncontrolled spread of API keys, passwords, and tokens across code, configs, and chat, far beyond any managed vault.

SQL injection

SQL injection lets attackers alter database queries by smuggling SQL through user input. The fix is parameterized queries, never string concatenation.

T

Technical debt

Technical debt is the future rework cost created by choosing a quick solution now, paid as interest on every change until it is refactored.

Test coverage

Test coverage measures how much of a codebase is executed by its tests. It proves what is untested; it cannot prove the tested parts are correct.