Security words, in plain English

A .env file is a plain text file of KEY=value lines that tools load into environment variables during development. It often holds real secrets, so it must be listed in .gitignore and never committed to a repository.

An access token is a credential issued after a user logs in or grants permission, which an app sends with each API request to prove it is allowed to act. It is meant to be short lived and limited in scope.

AI-generated code is source code written by a large language model from a prompt, rather than typed by a person. It can work correctly while still containing security flaws that nobody reviewed.

An anon key is the public API key a Supabase app ships to the browser so visitors can talk to the database. It is safe to expose only when Row Level Security limits what it can read and write.

An API key is a string that identifies your app to a service and usually authorizes its requests and billing. Whether it is safe to expose depends on the service: some keys are public by design, most are private.

A bearer token is a credential sent in an Authorization header, where whoever holds it is treated as the authorized user. Nothing else is checked, so anyone who steals the token can use it until it expires.

A brute force attack is an attempt to get in by trying many possible values, such as passwords, one-time codes or reset tokens, until one works. It succeeds when an app allows unlimited guesses.

Clickjacking is an attack where a malicious site loads your page inside an invisible frame and tricks a visitor into clicking a real button on it, such as delete, pay or approve, while they think they are clicking something else.

Content Security Policy is an HTTP response header that tells the browser which sources of scripts, images, styles and other resources a page may load, limiting the damage if an attacker manages to inject code.

CORS is a browser rule set, driven by HTTP headers, that says which other websites may read responses from your server. It restricts browsers only and does not stop curl, scripts or other servers from calling your API.

A CORS preflight request is an automatic OPTIONS request the browser sends before certain cross-origin calls, asking the server whether the real request's method and headers are allowed. The real request is sent only if the server agrees.

Credential stuffing is an attack where someone takes email and password pairs leaked from other websites and tries them automatically against your login. It works because many people reuse the same password across services.

A CSP nonce is a random value, generated fresh for every page response, that appears both in the Content-Security-Policy header and on each script tag you trust. The browser runs only the inline scripts that carry the matching value.

CSRF is an attack where a malicious website makes a logged-in visitor's browser send a request to your app, and the browser attaches their cookies automatically, so your server may treat the forged action as genuine.

A CVE is a publicly listed security flaw in a specific product or library, identified by a unique ID such as CVE-2024-12345, so everyone can refer to the same vulnerability and track its fix.

Dynamic application security testing, or DAST, is testing a running app from the outside by sending it crafted requests and watching the responses, the way an attacker would, to find exploitable weaknesses.

Denial of service is an attack that makes your app unavailable to real users by exhausting something it depends on, such as bandwidth, server capacity, database connections or a paid usage quota. When the traffic comes from many machines at once it is called a distributed denial of service, or DDoS.

Dependency confusion is a supply chain attack in which an attacker publishes a malicious package to a public registry under the same name as a company's private internal package, so that build tools install the attacker's version instead.

DKIM is an email authentication method in which the sending server adds a cryptographic signature to each message, and the receiver verifies it using a public key published in the sender's DNS. It shows the message really came from that domain and was not changed on the way.

DMARC is an email authentication policy, published as a DNS TXT record, that tells receiving mail servers what to do with messages claiming to be from your domain that fail SPF and DKIM checks, and where to send reports about them.

The Digital Personal Data Protection Act, 2023 is India's law on processing digital personal data, setting duties for organizations that decide why and how data is used and rights for the people it describes.

An edge function is a small piece of server-side code that a platform runs in data centres close to your users, used for tasks such as handling webhooks, calling third-party APIs and keeping secrets off the browser.

Encryption at rest means that data is stored in encrypted form on disks, databases and backups, so that someone who obtains the raw storage cannot read it without the encryption key.

Encryption in transit means that data is encrypted while it travels across a network, normally with TLS, the protocol behind HTTPS, so that nobody between the two ends can read or change it.

An environment variable is a named setting supplied to your app from outside its code, commonly used for keys and URLs. Some frameworks copy prefixed ones into the browser bundle, so a name can decide whether a value is public.

Firebase Security Rules are the access rules you write for Cloud Firestore, Realtime Database and Cloud Storage that decide which users may read or write each piece of data. They are enforced on Firebase's servers.

HSTS is a response header that tells browsers to use only HTTPS for your site for a set time, automatically upgrading plain HTTP requests and blocking users from clicking through certificate warnings.

HttpOnly is a cookie attribute that hides the cookie from JavaScript, so page scripts cannot read it through document.cookie. The browser still sends it to your server, which limits how much a cross-site scripting bug can steal.

IDOR is an access control flaw where changing an identifier in a request, such as an order number in a URL, lets one user view or edit another user's data because the server never checks who owns it.

A JWT is a compact, URL-safe token that carries claims, such as who a user is, and is usually signed so a server can tell it was not altered. Signed is not the same as encrypted: anyone holding it can read it.

Least privilege is the principle that every user, service, and key should get only the minimum access it needs to do its job, so a mistake or a stolen credential can do as little damage as possible.

A lockfile is a file, such as package-lock.json, that records the exact version of every dependency your project installed, so every install on every machine produces the same set of packages.

A magic link is a one-time login link sent to a user's email address. Clicking it signs them in without a password, because access to the inbox is treated as proof of identity.

Mass assignment is a flaw where an app copies every field from a request straight into a database record, letting an attacker set fields they were never meant to control, such as role, price, or is_admin.

Mixed content is when a page loaded over HTTPS pulls in scripts, images or other resources over plain HTTP. Those resources travel unencrypted, so someone on the network can read or alter them and weaken the secure page.

Model Context Protocol, or MCP, is an open standard for connecting AI applications to external systems such as files, databases and tools, so an assistant can read data and take actions through a common interface.

OAuth is a standard that lets one app get limited access to a user's account on another service, such as Google or GitHub, through an approval step, without ever seeing the user's password.

An open redirect is a flaw where your site sends visitors to whatever address appears in a URL parameter, without checking it. Attackers use it to make a phishing link look as if it leads to your trusted domain.

The OWASP Top 10 is a widely used awareness list, published by the Open Worldwide Application Security Project, of the ten most critical categories of web application security risk, updated every few years.

A passkey is a passwordless login credential based on FIDO standards. It uses a cryptographic key pair stored on the user's device and unlocked with a fingerprint, face or device PIN, and it resists phishing.

Password hashing is storing a one-way, deliberately slow, salted fingerprint of each password instead of the password itself, so a stolen database does not hand attackers everyone's real passwords.

Path traversal is an attack where someone puts sequences such as ../ into a file name your server uses, so it reads or writes files outside the folder it was meant to stay in. It is also called directory traversal.

A penetration test is an authorized, hands-on security assessment where a tester imitates real attackers against your app or systems to find weaknesses that could be exploited, then reports how to fix them.

Permissions-Policy is an HTTP header that lets a site switch browser features such as the camera, microphone and geolocation on or off for its own pages and for any content it embeds in iframes.

Personally identifiable information, or PII, is any information that can be used to distinguish or trace a specific person, either alone or when combined with other data, such as a name, email address, phone number or ID number.

PKCE, short for Proof Key for Code Exchange and pronounced "pixy", is an extension to OAuth that stops an attacker who intercepts a login authorisation code from exchanging it for tokens.

Prompt injection is an attack where text given to an AI model, from a user or from content the model reads, overrides its instructions and makes it behave in ways its builder did not intend.

A publishable key is an API key that is designed to be included in frontend code and seen by the public. It identifies your project but cannot perform sensitive operations by itself.

Rate limiting caps how many requests a client can make in a given time and rejects the excess, usually with an HTTP 429 response. It slows password guessing, scraping, spam and runaway bills from abuse.

Role-based access control, or RBAC, is a way of deciding what each user may do by giving them a role, such as admin or member, and attaching permissions to the role instead of to individual people.

Referrer-Policy is an HTTP header that controls how much of the current page's address the browser shares, in the Referer header, when a visitor follows a link or the page loads a resource from another site.

A refresh token is a long-lived credential that an app exchanges for a new access token when the old one expires, so the user stays signed in without entering their password again.

Remote code execution is a vulnerability that lets an attacker run their own commands or code on your server over the network. It is among the most serious flaws because the attacker can then act with everything the app can access.

Row Level Security is a Postgres feature that decides, row by row, which records each user may read or change, using rules called policies. In Supabase it is the main protection for data reachable from the browser.

SameSite is a cookie attribute that tells the browser whether to attach the cookie to requests that start on a different site, using the values Strict, Lax, or None, which limits cross-site request forgery.

Static application security testing, or SAST, is analysis of your source code without running it, using tools that look for insecure patterns such as injection flaws, hardcoded secrets, and unsafe function use.

A software bill of materials, or SBOM, is a formal, machine-readable list of every component and dependency that a piece of software is built from, including their versions and how they relate to each other.

A secret is any credential that grants access, such as an API key, database password, private key or signing key, and that must stay hidden from users, repositories and client-side code, and be rotated if it leaks.

Secret scanning is automated checking of code, commits, and other text for hardcoded credentials such as API keys, tokens, and passwords, so a leaked secret is flagged before someone else finds and abuses it.

Security headers are HTTP response headers that tell the browser to switch on extra protections for your site, such as forcing HTTPS, blocking framing by other sites and limiting which scripts may run.

security.txt is a small text file, served at /.well-known/security.txt on your website, that tells security researchers how to report a vulnerability to you. Its format is defined in RFC 9116.

A serverless function is backend code that a cloud platform runs on demand in response to a request or event, so you deploy a single function instead of managing a server that is always on.

A service role key is Supabase's all-powerful backend key that bypasses Row Level Security and can read, change or delete any data in your project. It must live only on a server you control, never in a browser or mobile app.

A session cookie is a small browser cookie that identifies a logged-in user to your server, and in the strict sense one with no expiry date that disappears when the browser session ends. Protect it with Secure, HttpOnly and SameSite.

A signed URL, also called a presigned URL, is a link to a private file that includes a cryptographic signature and an expiry time, giving whoever holds the link temporary access without needing to log in.

Single sign-on, or SSO, is an authentication setup where one account at a central identity provider is used to access many separate applications, so users log in once instead of once per app.

Slopsquatting is an attack where someone registers a package name that AI coding tools tend to invent, so that when you install the suggested but nonexistent dependency, you actually install attacker-controlled code.

A source map is a file that links your minified, bundled JavaScript back to your original source code so debuggers can show readable code. If published to production, it lets anyone read your unbundled frontend source.

An SPF record is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving mail servers check it to help spot messages that forge your address.

SQL injection is an attack where user input is inserted into a database query as code, letting an attacker read, change or delete data they should not reach. Parameterized queries prevent it by keeping input separate from the query.

An SSL certificate is a digital file that proves a website's identity and lets browsers set up an encrypted HTTPS connection to it. The accurate modern name is TLS certificate, but the older term is still widely used.

Server-side request forgery, or SSRF, is a flaw where an attacker tricks your server into sending requests to a destination they choose, often internal services or cloud credential endpoints the attacker cannot reach directly.

A storage bucket policy is the set of rules that decides who can list, read, upload and delete files in a cloud storage bucket, such as Supabase Storage, Amazon S3 or Cloudflare R2.

Subdomain takeover is an attack where someone gains control of one of your subdomains because its DNS record still points at a hosting service or resource you have deleted, which the attacker then claims for themselves.

Subresource Integrity is a browser feature that lets you attach a cryptographic hash to a script or stylesheet tag, so the browser refuses to run the file if its contents do not match what you expected.

A supply chain attack is an incident where an attacker compromises something your software depends on, such as a library, build tool, or service, so the harm reaches you through code you chose to trust.

A threat model is a structured description of what you are protecting, who might attack it, how they could, and what you will do about it, made before problems appear so you spend effort on the risks that matter.

TLS is the protocol that encrypts traffic between a browser and a server, and proves the server is who it claims to be. It is what puts the S in HTTPS, and it replaced the older SSL protocol.

Two-factor authentication, or 2FA, is a login method that requires two different kinds of proof, such as a password plus a code from a phone app or a hardware key, so a stolen password alone is not enough.

Vibe coding is a way of building software by describing what you want to an AI model in plain language and accepting the code it writes, often without reading or fully understanding that code.

A vulnerability scanner is an automated tool that examines an application, its code, its dependencies or its infrastructure for known security weaknesses and reports what it finds so they can be fixed.

A webhook signature is a cryptographic value that a service such as Stripe or GitHub attaches to each webhook request, so your server can prove the request really came from that service and was not altered.

X-Frame-Options is an HTTP response header that tells the browser whether your page may be displayed inside a frame on another site. Setting it to DENY or SAMEORIGIN is a standard defense against clickjacking.

XSS is an attack where an attacker gets your site to run their JavaScript in other visitors' browsers, usually by slipping untrusted input into a page without escaping it. The script then acts with the victim's access.