Security words, in plain English

A .env file is a plain text file of KEY=value lines that tools load into environment variables during development. It often holds real secrets, so it must be listed in .gitignore and never committed to a repository.

An anon key is the public API key a Supabase app ships to the browser so visitors can talk to the database. It is safe to expose only when Row Level Security limits what it can read and write.

An API key is a string that identifies your app to a service and usually authorizes its requests and billing. Whether it is safe to expose depends on the service: some keys are public by design, most are private.

A bearer token is a credential sent in an Authorization header, where whoever holds it is treated as the authorized user. Nothing else is checked, so anyone who steals the token can use it until it expires.

Content Security Policy is an HTTP response header that tells the browser which sources of scripts, images, styles and other resources a page may load, limiting the damage if an attacker manages to inject code.

CORS is a browser rule set, driven by HTTP headers, that says which other websites may read responses from your server. It restricts browsers only and does not stop curl, scripts or other servers from calling your API.

CSRF is an attack where a malicious website makes a logged-in visitor's browser send a request to your app, and the browser attaches their cookies automatically, so your server may treat the forged action as genuine.

A CVE is a publicly listed security flaw in a specific product or library, identified by a unique ID such as CVE-2024-12345, so everyone can refer to the same vulnerability and track its fix.

Dynamic application security testing, or DAST, is testing a running app from the outside by sending it crafted requests and watching the responses, the way an attacker would, to find exploitable weaknesses.

The Digital Personal Data Protection Act, 2023 is India's law on processing digital personal data, setting duties for organizations that decide why and how data is used and rights for the people it describes.

An environment variable is a named setting supplied to your app from outside its code, commonly used for keys and URLs. Some frameworks copy prefixed ones into the browser bundle, so a name can decide whether a value is public.

HSTS is a response header that tells browsers to use only HTTPS for your site for a set time, automatically upgrading plain HTTP requests and blocking users from clicking through certificate warnings.

HttpOnly is a cookie attribute that hides the cookie from JavaScript, so page scripts cannot read it through document.cookie. The browser still sends it to your server, which limits how much a cross-site scripting bug can steal.

IDOR is an access control flaw where changing an identifier in a request, such as an order number in a URL, lets one user view or edit another user's data because the server never checks who owns it.

A JWT is a compact, URL-safe token that carries claims, such as who a user is, and is usually signed so a server can tell it was not altered. Signed is not the same as encrypted: anyone holding it can read it.

Least privilege is the principle that every user, service, and key should get only the minimum access it needs to do its job, so a mistake or a stolen credential can do as little damage as possible.

A lockfile is a file, such as package-lock.json, that records the exact version of every dependency your project installed, so every install on every machine produces the same set of packages.

Mass assignment is a flaw where an app copies every field from a request straight into a database record, letting an attacker set fields they were never meant to control, such as role, price, or is_admin.

OAuth is a standard that lets one app get limited access to a user's account on another service, such as Google or GitHub, through an approval step, without ever seeing the user's password.

The OWASP Top 10 is a widely used awareness list, published by the Open Worldwide Application Security Project, of the ten most critical categories of web application security risk, updated every few years.

Password hashing is storing a one-way, deliberately slow, salted fingerprint of each password instead of the password itself, so a stolen database does not hand attackers everyone's real passwords.

A penetration test is an authorized, hands-on security assessment where a tester imitates real attackers against your app or systems to find weaknesses that could be exploited, then reports how to fix them.

Prompt injection is an attack where text given to an AI model, from a user or from content the model reads, overrides its instructions and makes it behave in ways its builder did not intend.

Rate limiting caps how many requests a client can make in a given time and rejects the excess, usually with an HTTP 429 response. It slows password guessing, scraping, spam and runaway bills from abuse.

Role-based access control, or RBAC, is a way of deciding what each user may do by giving them a role, such as admin or member, and attaching permissions to the role instead of to individual people.

Row Level Security is a Postgres feature that decides, row by row, which records each user may read or change, using rules called policies. In Supabase it is the main protection for data reachable from the browser.

SameSite is a cookie attribute that tells the browser whether to attach the cookie to requests that start on a different site, using the values Strict, Lax, or None, which limits cross-site request forgery.

Static application security testing, or SAST, is analysis of your source code without running it, using tools that look for insecure patterns such as injection flaws, hardcoded secrets, and unsafe function use.

A secret is any credential that grants access, such as an API key, database password, private key or signing key, and that must stay hidden from users, repositories and client-side code, and be rotated if it leaks.

Secret scanning is automated checking of code, commits, and other text for hardcoded credentials such as API keys, tokens, and passwords, so a leaked secret is flagged before someone else finds and abuses it.

A service role key is Supabase's all-powerful backend key that bypasses Row Level Security and can read, change or delete any data in your project. It must live only on a server you control, never in a browser or mobile app.

A session cookie is a small browser cookie that identifies a logged-in user to your server, and in the strict sense one with no expiry date that disappears when the browser session ends. Protect it with Secure, HttpOnly and SameSite.

Slopsquatting is an attack where someone registers a package name that AI coding tools tend to invent, so that when you install the suggested but nonexistent dependency, you actually install attacker-controlled code.

A source map is a file that links your minified, bundled JavaScript back to your original source code so debuggers can show readable code. If published to production, it lets anyone read your unbundled frontend source.

SQL injection is an attack where user input is inserted into a database query as code, letting an attacker read, change or delete data they should not reach. Parameterized queries prevent it by keeping input separate from the query.

Server-side request forgery, or SSRF, is a flaw where an attacker tricks your server into sending requests to a destination they choose, often internal services or cloud credential endpoints the attacker cannot reach directly.

A supply chain attack is an incident where an attacker compromises something your software depends on, such as a library, build tool, or service, so the harm reaches you through code you chose to trust.

A threat model is a structured description of what you are protecting, who might attack it, how they could, and what you will do about it, made before problems appear so you spend effort on the risks that matter.

Two-factor authentication, or 2FA, is a login method that requires two different kinds of proof, such as a password plus a code from a phone app or a hardware key, so a stolen password alone is not enough.

XSS is an attack where an attacker gets your site to run their JavaScript in other visitors' browsers, usually by slipping untrusted input into a page without escaping it. The script then acts with the victim's access.