Learning Center

Plain-language explanations of the concepts this platform uses, no coding experience assumed.

Security concepts

These are the kinds of issues the security scanner looks for. You'll also see a “Teach Me” link pointing here whenever one of these shows up in your own project.

Exposed secrets

Like writing your house key's shape on a sticky note and leaving it on the front door.

Environment configuration

Like a store accidentally leaving its "we are closed, alarm is off" sign up during business hours.

Missing authentication

Like a door that everyone assumes is locked, but no one actually installed a lock on.

Authorization gap (IDOR)

Like a hotel room key that's supposed to only open your room, but actually opens any room if you just guess the room number.

Dependency vulnerability

Like a lock brand issuing a recall because a specific model can be picked easily.

Row-Level Security

Like a shared filing cabinet where every drawer is supposed to check your ID before opening, drawer by drawer, not just one lock on the front door.

Security configuration

Like a building with locks installed, but several of them left in the "unlocked" position.

Injection / unsafe sink

Like a form that's supposed to only accept your name, but if you write instructions instead, the system follows them.

Sensitive data exposure

Like a receipt that prints your full card number instead of just the last four digits.

Unauthenticated table reachability

Like a warehouse whose loading dock door was left open to the street.

Live endpoint finding

Like actually knocking on a door to see if it opens, instead of just checking the blueprint.

Possible implementation gap

Like a building having a sign that says "employees only" while the actual back door has no lock.

Possible control loophole

Like a vault door with a hidden latch that opens it from the outside.

Glossary

Everyday coding and web terms you'll run into around this platform.

API: A set way for two pieces of software to talk to each other, like a menu of requests your app's frontend can make to its backend, or that other apps can make to yours.
Endpoint: One specific URL your app responds to, usually tied to one action, e.g. "/api/login" or "/api/invoices/42".
Database: Where your application stores information permanently, so it is still there after the app restarts: user accounts, orders, documents, and so on.
Repository: A project's complete history of code, stored and tracked by a tool like Git. "Your repo" usually means your project's codebase on GitHub.
Commit: A saved snapshot of a set of code changes, with a message describing what changed.
Branch: A separate line of work in a repository, so you can make changes without affecting the main version until you are ready.
Deployment: The process of taking your code and making it live: running on a real server where users can reach it.
Authentication: Proving who someone is, usually by checking a password, a login link, or a code sent to their device.
Authorization: Deciding what someone who's already proven who they are is allowed to do or see. Authentication answers "who are you?"; authorization answers "what can you access?"
Middleware: Code that runs before a request reaches its final destination, often used to check authentication, log requests, or block bad traffic.
Environment Variable: A setting or secret (like a password or API key) stored outside your code, so it can differ between your computer and production without editing files.
Dependency: Someone else's code your project relies on to work: a package you installed instead of writing yourself.
Package: A bundle of reusable code you can install into your project, usually via a tool like npm.
Framework: A foundation of pre-built structure and tools your app is built on top of, e.g. Next.js, React, Rails.
Runtime: The environment your code actually executes in, e.g. Node.js in the browser vs. on a server.
Server: A computer (often far away, in the cloud) that runs your backend code and responds to requests.
Client: The user's side of the interaction, usually their web browser or mobile app, sending requests to your server.
Frontend: The part of your application people see and interact with directly: the interface.
Backend: The part of your application that runs on a server, handling data, logic, and security that users don't see directly.
Webhook: A way for one service to automatically notify another when something happens, e.g. GitHub telling your app "a new commit was just pushed."
Token: A piece of data used to prove you're allowed to do something, usually issued after logging in, instead of sending your password on every request.
Cookie: A small piece of data a website stores in your browser, often used to keep you logged in between visits.
Session: A period of time a user is considered "logged in," tracked by the server or by a cookie in the browser.
JWT: "JSON Web Token": a common, compact format for tokens that proves who a user is without the server needing to look them up every time.
CORS: "Cross-Origin Resource Sharing": a browser security rule that controls which websites are allowed to make requests to your API from a different domain.
HTTPS: The secure version of HTTP: it encrypts traffic between a user's browser and your server so it can't be read or tampered with in transit.
SQL: The language used to ask a traditional (relational) database for data, e.g. Postgres, MySQL.
NoSQL: A database that doesn't use SQL's table-and-row structure; often storing flexible documents instead, e.g. MongoDB.
Stack Trace: The list of steps your code was in the middle of when it crashed. Read from the top down, it usually points to exactly where the problem happened.
Build: The process of turning your source code into the optimized files that actually run in production.
Compiler: A tool that translates code you write into a form a computer (or browser) can run.
Runtime Error: A mistake that only shows up while the program is actually running, as opposed to one caught earlier, e.g. by a type checker.