Glossary

Application security terms, defined plainly

About this page

Definitions of the security terms used across this site — penetration testing, VAPT, BOLA, IDOR, OWASP MASVS and ASVS, threat modelling, STRIDE, CVSS, SAST and DAST — written so a non-specialist can use them correctly in a scoping conversation.

Penetration test
An authorised, simulated attack on a system performed by a person, intended to prove which weaknesses are exploitable and what an attacker reaches through them.
Vulnerability assessment
A largely automated review that lists known weaknesses across a system without proving whether each one can be exploited in context.
VAPT
Vulnerability Assessment and Penetration Testing: a combined engagement pairing broad automated coverage with narrow manual exploitation, commonly required by Indian compliance frameworks.
BOLA
Broken Object Level Authorisation: an API flaw where an authenticated user can access another user's records by changing an identifier, because ownership is never checked server side.
IDOR
Insecure Direct Object Reference: the web-application name for the same flaw as BOLA — a reference to an object that is not validated against the requester's permissions.
OWASP MASVS
The Mobile Application Security Verification Standard: OWASP's control set defining what a secure Android or iOS application must do, at two verification levels plus a resilience set.
OWASP ASVS
The Application Security Verification Standard: OWASP's catalogue of web application security requirements, used to define and evidence test coverage at a chosen level.
Threat modelling
A structured design-stage analysis that maps data flows and trust boundaries, enumerates how components can be abused, and ranks the controls worth building.
STRIDE
A threat classification covering Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege, applied element by element during threat modelling.
CVSS
The Common Vulnerability Scoring System: a standard method for rating vulnerability severity from 0 to 10, based on exploitability and impact characteristics.
CWE
Common Weakness Enumeration: a catalogue of software weakness types used to classify the underlying cause of a finding rather than its instance.
Certificate pinning
A mobile and client-side control that accepts only a specific certificate or public key for a host, preventing interception by a locally installed trusted certificate.
Mass assignment
A flaw where an endpoint binds an entire request body to a data model, letting an attacker set privileged fields such as role or balance that the client never displays.
SAST
Static Application Security Testing: analysis of source code without executing it, useful for coverage and pattern detection, and requiring human triage to be usable.
DAST
Dynamic Application Security Testing: automated testing of a running application from the outside, effective for known issue classes and blind to business-logic flaws.
Retest
A short verification engagement confirming that reported findings were actually closed by the fixes deployed, producing the report version shared with customers and auditors.
Rules of engagement
The written agreement fixing what may be tested, when, by which methods, and who to contact — the document that makes a penetration test lawful and safe.
Attestation letter
A short signed statement confirming that a named system was tested on a given date to a stated methodology, shareable with customers who may not receive the full report.

Want this tested properly?

Scope and a fixed quote within two working days. First consultation is free.