Resources/Glossary
Definitions.
From the vocabulary that runs the platform.
The entity types and verbs below are the frozen vocabulary in the code; the platform terms are how we use them. If a word on this site is not here, tell us.
Platform terms
How we use the words.
- Tool plan
- The set of scanners launched for a target. For repositories: native engine, semgrep, gitleaks, architecture, checkov, syft, grype plus language-specific tools detected from the repository.
- Scan band
- The untrusted zone where every scanner runs: ephemeral Kubernetes Jobs in a dedicated namespace with target credentials only.
- Split secret
- Two Kubernetes Secrets per job: acquisition credentials for the tool container, a scan token and body-signing key for the adapter. No container holds both.
- Callback
- The single authenticated path by which results enter the platform: per-scan single-use token, HMAC body signature, replay nonce.
- Observation
- A raw result from one tool about one thing. Observations are accepted or quarantined and resolved into entities and findings.
- Provenance class
- How an edge was established: observed (telemetry, provider API, verified attestation),derived (deterministic join over immutable identifiers) or inferred (heuristic candidate, never on a strict path).
- Lineage
- The expected-hop walk Repository → Commit → Build → ContainerImage → Registry → Workload → KubeService → KubeIngress over observed and derived edges.
- Missing hop
- A hop the lineage template expects but the graph does not have, reported with a reason:
no_producer_data,source_gaporunbound_endpoint. Never stored. - Conflict
- Two sources make incompatible claims about the same hop. Read-time only; resolved at the source.
- Blast radius
- A bounded downstream walk from a subject to every workload, service and ingress that carries it. Sibling findings are excluded from the count.
- Exploit path
- A computed path from an exposure edge through identities, roles and policies to an asset, with chokepoints and interventions.
- Reachability hint
- For a dependency finding:
reachable,not_reachableorunknownwith a confidence and, when reachable, a call path. - Evidence kind
- One of seven typed carriers on a native finding: code span, dataflow path, dependency path, config path, request trace, exploit proof, artifact hash.
- Disposition
- A human verdict on a finding — true positive, false positive, by design, accepted risk — with a mandatory reason code. Never written by AI or workers.
- Decision
- An Ed25519-signed policy evaluation over a canonical payload. An evaluator error is a deny with
OPA_EVALUATION_FAILED. - Audit chain
- The append-only audit log where each record carries the HMAC of its predecessor.
- Execution cluster
- A customer-registered Kubernetes cluster, trusted after fingerprint approval, that receives scan Jobs so code never leaves the customer's network.
- Persona
- A view-tier role (developer, AppSec, cloud, SOC, GRC, executive, …) that selects a home view. Access is decided by RBAC, never by persona.
- Cross-walk
- A pair-wise control equivalence between frameworks; the transitive closure is computed on demand so adding a framework is linear work.
- Scan states
PENDING → QUEUED → RUNNING → COMPLETED | PARTIAL | FAILED | FAILED_TIMEOUT | FAILED_DEPENDENCY | FAILED_CONFIG.
Ontology · entity types (52)
Every noun the graph can hold.
The vocabulary is frozen and versioned. v2 additions are marked; nothing in v1 was changed to make room for them.
Organisation & topology
Organization- The tenant. Every row is scoped to one.
BusinessUnit- A division that owns services.
Team- An owning group; findings route to it.
User- A person with a principal in the platform.
BusinessService- A product or capability the business names.
Application- A deployable system that a service is made of.
Source to production
Repository- A source-control repository.
Commit- A specific revision, identified by full SHA.
Build- A CI run that consumed a commit.
Artifact- A build output that is not an image.
ContainerImage- An OCI image identified by digest, never by tag.
Package- A dependency at a version.
SBOMComponent- A component row from a generated or uploaded SBOM.
Registry- Where images are stored (v2).
Cloud & infrastructure
CloudAccount- An AWS account, Azure subscription or GCP project.
CloudResource- Any provider resource, identified by ARN or equivalent.
Cluster- A Kubernetes cluster.
Namespace- A Kubernetes namespace (v2).
Workload- A running deployment, statefulset, job or pod set.
KubeService- A Kubernetes Service fronting a workload (v2).
KubeIngress- An ingress exposing a service (v2).
Endpoint- A network-reachable address, often from EASM.
NetworkZone- A trust zone or segment.
Identity & access
HumanIdentity- A person's identity from the IdP.
WorkloadIdentity- A service identity such as a service account.
CloudPrincipal- A cloud IAM principal.
IdentityGroup- A group in the IdP or cloud.
IAMRole- An assumable role.
AccessPolicy- A permission policy document.
AccessEntitlement- A resolved grant of access.
Credential- A stored secret used to reach a target.
Secret- A secret discovered in code, history or configuration.
API & data
API- A discovered API surface.
APIRoute- One route on an API.
DataStore- A database, bucket or queue.
DataAsset- A dataset inside a store.
DataClassification- A sensitivity label such as PII or PHI.
Security objects
Vulnerability- A CVE or advisory.
Weakness- A CWE class.
Misconfiguration- A failed configuration check.
Control- A framework control.
Threat- A modelled threat.
Technique- An ATT&CK technique.
Indicator- An indicator of compromise.
Findings & response
Finding- A logical finding: one issue, many corroborating observations.
Exposure- A reachability fact that makes a finding matter.
SecurityCase- A correlated group of findings produced by a rule.
Incident- A declared incident.
Remediation- A planned or executed fix.
Exception- An approved, expiring deviation.
Ticket- An external ticket linked to a finding.
Decision- A signed policy decision.
Ontology · relationship verbs (32)
Every edge the graph can draw.
Stored source → target as listed. Every edge carries a provenance class.
owns- Team → Repository / Application / CloudResource
member_of- User → Team, Identity → Group
supports- Application → BusinessService
contains- Repository → Commit, Cluster → Namespace, Namespace → Workload
depends_on- Application → Application, Package → Package
builds- Repository → ContainerImage (v1)
triggered- Commit → Build (v2)
produces- Build → ContainerImage
stored_in- ContainerImage → Registry (v2)
deploys_to- Entity → CloudResource
runs_on- Workload → Cluster / node
runs_image- Workload → ContainerImage, by digest
hosted_in- CloudResource → CloudAccount (v2)
routes_to- KubeService → Workload
reachable_to- Endpoint → Workload
exposes- KubeIngress → KubeService, Endpoint → CloudResource
authenticates_as- Workload → WorkloadIdentity
assumes- Principal → IAMRole
can_access- IAMRole → DataStore / Secret
stores- DataStore → DataAsset
processes- Workload → DataAsset
affects- Finding → subject entity (v2)
affected_by- Entity → Vulnerability
violates_control- Finding → Control
maps_to- Control → Control across frameworks
corroborates- Observation → Finding
contradicts- Observation → Finding
duplicate_of- Finding → Finding
derived_from- Entity → source observation
remediated_by- Finding → Remediation
verified_by- Remediation → Scan
fixes- Remediation → Finding (v2)