8 terms · stable anchors
Glossary
The vocabulary of the field, one tight definition at a time. Every term has a permanent anchor — link to it from anywhere.
C
- § Content Security Policy
-
A browser security mechanism, delivered as an HTTP response header, that declares which sources of scripts, styles, and other resources a page is allowed to load or execute. A strict CSP turns many script-injection bugs from exploitable vulnerabilities into logged, blocked attempts — which is why it is the standard second layer of defense against cross-site scripting.
- § Cross-site scripting
-
A vulnerability class where an attacker gets their own JavaScript to execute in another user’s browser, inside a site that user trusts. It happens when applications place untrusted input into a page without correct encoding. Because the injected script runs with the site’s full privileges, it can read sessions, forge actions, and rewrite the page.
P
- § Penetration testing
-
The authorized, scoped simulation of real attacks against a system to find exploitable weaknesses before adversaries do. The word that matters is authorized: a penetration test is defined by written permission, agreed rules of engagement, and a report the owner can act on. The same activity without permission is simply a crime.
- § Phishing
-
A social-engineering attack that impersonates a trusted party — an employer, a bank, a colleague — to trick a person into revealing credentials, approving access, or running malware. Phishing succeeds against attention, not intelligence. Durable defenses are structural: phishing-resistant multi-factor authentication, verified communication channels, and a culture where reporting a suspected phish is fast and blameless.
S
- § Same-origin policy
-
The browser’s foundational security rule: script running on one origin — the combination of scheme, host, and port — may not read data belonging to a different origin. It is why a random tab cannot read your webmail. Nearly every web security mechanism, from CORS to cookie attributes, is a carefully controlled exception to or reinforcement of this rule.
- § SQL injection
-
An injection attack where user input is concatenated into a database query so that the input is executed as SQL rather than treated as data. A single vulnerable query can expose or destroy an entire database. The defense is categorical, not clever: parameterized queries, which keep code and data on separate channels no matter what the input contains.
T
- § Threat model
-
A structured answer to four questions: what are you protecting, from whom, what can they actually do, and what happens if they succeed. Threat modeling turns vague anxiety into ranked, addressable risks. It is the difference between security work that responds to headlines and security work that responds to your system’s real attack surface.
Z
- § Zero-day
-
A vulnerability that is exploited before the vendor knows it exists — the defenders have had zero days to fix it. Zero-days are rare, expensive, and dominate headlines, but the overwhelming majority of real breaches use known, patchable flaws. A sober threat model treats zero-days as a tail risk, not the default explanation for incidents.