Learning Center
Our mission is to provide the most comprehensive and up-to-date security knowledge for developers, testers, and security professionals.
S
- Server-side request forgery (SSRF)Server-side request forgery (SSRF) is a vulnerability where an attacker makes a server send HTTP requests to a destination of the attacker's choosing, reaching internal services, cloud metadata endpoints, and other hosts the attacker cannot address directly.
- Shadow APIA shadow API is an API endpoint, version or host that runs in production but is missing from the organization's inventory and documentation, so it skips the security reviews, gateway policies and monitoring applied to known APIs and often exposes old or unprotected functionality to anyone who finds it.
- Shift-left securityShift-left security is the practice of moving security checks earlier in software development, into design, the developer's editor and the pull request, so threat models, static analysis, dependency checks and secrets scanning catch flaws before code merges, while a fix is still a small edit to the author's own change.
- Software bill of materials (SBOM)A software bill of materials (SBOM) is a machine-readable inventory of the components inside a piece of software, listing each library's name, version, supplier, unique identifier and dependency relationships, so the people who build, buy or run the software can check which of those components have known vulnerabilities or license problems.
- SQL injection (SQLi)SQL injection (SQLi) is a vulnerability where user input is concatenated into a database query, letting an attacker change the query's logic to read rows they should not see, bypass login checks, modify or delete data, and sometimes run commands on the database server.
- Static application security testing (SAST)Static application security testing (SAST) is automated analysis of source code, bytecode or binaries, without running the application, that traces untrusted input to dangerous operations such as SQL queries, shell commands and HTML output, and reports the file and line where an injection or similar flaw could occur.
- Subdomain takeoverA subdomain takeover is a vulnerability where a DNS record still points to a deprovisioned cloud resource, letting an attacker register that resource and serve their own content from a subdomain the organization still owns, such as a dangling CNAME to a deleted host.
T
V
Z
