Glossary

Plain-language definitions for software and security

Short, accurate explanations of the terms that come up when you design, build and secure a digital product, each with an example and the pages that go deeper.

Start a project

API: An API, or application programming interface, is a defined way for one piece of software to ask another for data or to perform an action. It sets out what you can request, how to ask and what comes back.
CI/CD: CI/CD stands for continuous integration and continuous delivery (or deployment). It is a set of automatic steps that build, test and release your code every time it changes, so releases are small, frequent and predictable.
Content Security Policy: A Content Security Policy (CSP) is a set of rules, sent by a website as an HTTP response header, that tells the browser which sources of scripts, styles, images and frames the page may use. If injected code does not come from an allowed source, the browser refuses to run it.
Cross-platform app: A cross-platform app is a mobile app built once from a single codebase and released on both iOS and Android. Frameworks such as Flutter and React Native make this possible.
Cross-site scripting: Cross-site scripting (XSS) is a flaw that lets an attacker get their own script to run in another user's browser, as if it came from your site. The script can then act as that user, read what they can see or change what the page shows.
Design system: A design system is a shared library of reusable components, design tokens and written rules that lets a team build every screen of a product the same way. It is the single source of truth that designers and developers both work from.
Headless CMS: A headless CMS is a content management system that stores and manages content but has no built-in website. It delivers the content through an API to any front end you choose: a website, a mobile app or both.
Localisation: Localisation (also spelled localization, or l10n) is adapting a product to a specific language and region, so it feels native to the people who use it. It goes beyond translation to cover dates, numbers, currency, layout direction, imagery and tone.
Multi-factor authentication: Multi-factor authentication (MFA) asks a person for two or more different kinds of proof that they are who they claim to be, usually something they know, something they have or something they are. A stolen password alone is then not enough to get into the account.
MVP: An MVP, or minimum viable product, is the smallest working version of a product that lets you test your main idea with real users. It is built to learn, not to be complete.
Native app: A native app is a mobile app built specifically for one platform, using that platform's official language and tools: usually Swift for iOS and Kotlin for Android. It has direct access to everything the device offers.
No-code: No-code is a way of building websites, apps and workflows with visual editors and ready-made blocks instead of writing code. It is fast to start and works well for a first version, with limits you should know before you commit.
OWASP Top 10: The OWASP Top 10 is a regularly updated list of the most critical security risks to web applications, published by OWASP, the Open Worldwide Application Security Project, a non-profit community. It is an awareness document: a shared starting point for talking about web security, not a complete checklist.
Penetration testing: Penetration testing, or a pen test, is an authorised attack on your own application or network, carried out by a skilled tester to find weaknesses a real attacker could exploit. It ends with a written report of what was found, how serious it is and how to fix it.
RTL design: RTL design is the practice of designing and building interfaces for languages written right to left, such as Arabic, Hebrew, Persian and Urdu. The layout, reading order and navigation flow from right to left, and the details are adapted, not just flipped.
SaaS: SaaS, or software as a service, is software that a provider hosts and customers use over the internet, usually by subscription, instead of installing and running it themselves. One running system serves many customers at once.
Secure code review: Secure code review is the practice of reading source code, by a person and with tools, specifically to find security flaws before the code ships. Reviewers look for the places where a mistake would let someone read, change or break something they should not.
SQL injection: SQL injection is a flaw where an application builds a database query from untrusted input in a way that lets an attacker change the query itself. The attacker can then read, alter or delete data the application never meant to expose.
Threat modelling: Threat modelling is a structured way of asking what could go wrong with a system, who might cause it and what you will do about it, ideally before the system is built. The result is a short list of prioritised risks and the decisions that address them.
WCAG: WCAG, the Web Content Accessibility Guidelines, is the international standard for making websites and apps usable by people with disabilities. It is published by the World Wide Web Consortium (W3C), and many accessibility policies and contracts refer to it.

Ready to build something secure?

Tell us about your product. We will reply with a clear plan.

Start a project