The words your developer uses, explained

We refuse to put these words in a report, because a founder should never need a dictionary to understand what is wrong. But you will meet them elsewhere: in your building tool, in a forum, in a scary blog post. Here is each one in two plain sentences: what it is, and what it costs you if it is wrong.

Row Level Securityalso called RLS

A rule on a table in your database that says who is allowed to read or change each row. New tables start with no such rule, so nothing is protected until someone adds one.

What it costs you With no rule, anyone who finds the address of the table can read every row in it, straight from a browser. This is the most common serious leak in AI-built apps.

Anon keyalso called public key, publishable key

A code your app hands to every visitor so their browser can talk to your database. It is meant to be public and is safe on its own.

What it costs you Nothing, by itself. It only becomes dangerous when a table has no rule about who may read it, because then the public key is all a stranger needs.

Service keyalso called service role key, secret key

The master key to your database. It ignores every rule you set about who can read what, so it is meant to live only on your server, never in a visitor’s browser.

What it costs you If this ends up in the code your site sends to browsers, anyone who looks can read, change or delete everything you hold. It is one of the worst things to expose.

API key

A password your app uses to talk to another service, like the one that takes payments or sends email. Each one is meant to be kept private on your server.

What it costs you If one is left in the code a visitor can see, someone can copy it and spend your money or send email as you. The bill is often how you find out.

Endpointalso called API endpoint

A specific address your app talks to behind the scenes to fetch or save data, separate from the pages a person clicks through.

What it costs you If one of these addresses hands back data without checking who is asking, a stranger can call it directly and get information the pages would never show them.

CORSalso called cross-origin resource sharing

A setting that decides which other websites are allowed to make your app do things on a signed-in visitor’s behalf.

What it costs you Set too loosely, another website can quietly act as your logged-in customer, reading or changing their data without them knowing.

CSRFalso called cross-site request forgery

A trick where a visitor who is logged in to your app is made to perform an action on it without meaning to, by visiting a different, malicious page.

What it costs you A customer could change their email or make a purchase they never intended, simply by opening the wrong link while signed in to your app.

SSRFalso called server-side request forgery

A trick where a stranger makes your app fetch something on their behalf, and your app’s server does it while trusting them.

What it costs you Your server can be tricked into reaching internal systems a stranger could never reach directly, including the keys that run your hosting. This is how some large breaches started.

XSSalso called cross-site scripting

When an app shows text a visitor typed without cleaning it first, so someone can slip in instructions that run inside other visitors’ browsers.

What it costs you An attacker’s code runs as if it were your app, so it can steal what your customers type or take over their signed-in session.

IDORalso called insecure direct object reference, BOLA

When an app trusts a visitor’s word about which record they are asking for, instead of checking they are allowed to see it.

What it costs you Someone changes a number in the address, say from their order to order 124, and is handed a stranger’s order. Every customer’s data becomes reachable one number at a time.

SQL injection

When an app builds a database instruction out of whatever a visitor typed, so a carefully written entry becomes a command instead of plain text.

What it costs you A stranger who types the right thing into a box can read, change or delete your whole database. It is one of the oldest and most damaging faults.

JWTalso called JSON web token, bearer token

A signed pass your app gives a visitor after they log in, which their browser shows on each request to prove who they are.

What it costs you If one is stored carelessly or never expires, someone who gets hold of it can act as that customer until it is changed.

Environment variablealso called env var, .env file

A setting kept outside your code, usually for secrets like keys and passwords, so they are not written into the app itself.

What it costs you If the file holding these is published with your app by mistake, every secret in it is exposed at once. We check for this.

CSPalso called content security policy

A setting that tells a browser which sources of code and images it is allowed to load on your page.

What it costs you Without it, if someone manages to slip code onto your page, nothing stops that code from running. It is a seatbelt: you hope not to need it, but its absence makes a crash worse.

404also called not found, dead link, broken link

The response a website gives when a page does not exist. A link that leads to one is a dead end.

What it costs you A visitor on the way to buying who hits a dead end usually leaves. A dead "pricing" or "sign up" link is a lost sale every time someone clicks it.

HTTPSalso called SSL, TLS, the padlock

The lock that scrambles what travels between a visitor’s browser and your site so no one in between can read it.

What it costs you Without it, anything your customers type, passwords, card details, can be read by anyone on the same network, and browsers warn people away from your site.

Meeting one of these because a scan of your own app found it? Run a free check and we will explain your findings without any of these words.