Security & Access

Your app's secret pass

A secret code that identifies and authorises your app when it calls an API. It should be kept private, like a password.

Open Authorization

The standard that lets an app access your data on another service without seeing your password. It is the foundation of 'Sign in with Google' and similar sign-in buttons.

Single Sign-On

Logging in once to gain access to many connected apps without re-entering your details.

Multi-Factor / Two-Factor Authentication

Requiring a second proof of identity beyond the password, usually a code from a phone or an authenticator app.

Two places data needs protecting

At rest means stored data is encrypted on disk; in transit means it is encrypted while moving across the network. Buyers and auditors will ask about both.

Penetration Test

An authorised simulated attack on your system by security specialists, to find weaknesses before someone else does. Often required before an enterprise contract.

Common Vulnerabilities and Exposures

A known security weakness. CVE is the public catalogue that gives each one a reference number so everyone can track it.

UK GDPR and the Data Protection Act

The rules on handling personal data: what you may collect, why, how long you keep it and what rights people have over it. Non-compliance carries real financial penalties.

Never assume, always verify

A security model that treats every request as untrusted regardless of where it comes from, rather than assuming anything inside the network is safe.

The record of who did what

An immutable record of actions taken in a system. Increasingly expected by enterprise buyers, and essential when something goes wrong.

Identity and Access Management

The policies and systems used to manage identities and decide who or what can access particular resources.

Role-Based Access Control

An access model where permissions are assigned to roles and people receive permissions through the roles they hold.

Security principle

Giving each person, service or process only the minimum access needed for its job, for only as long as needed.

Credential protection practice

Securely storing, issuing, rotating, auditing and revoking sensitive credentials such as API keys, passwords and certificates.

Software Bill of Materials

A machine-readable inventory of the software components and dependencies inside a product, used to understand supply-chain and vulnerability exposure.

Security design practice

A structured way to identify what could attack a system, where trust boundaries and data flows create risk, and which controls are needed.

Development, Security and Operations

The practice of integrating security checks and responsibilities throughout software development and operations rather than leaving them until the end.

Coined adjective from thwart + -ly

Designed to anticipate and prevent harm, deception or unwanted action before it succeeds.