Every security term

$1 A numbered placeholder in a Postgres query, filled from the values list.
301 redirect A permanent move. Use it to send every plain HTTP request to the HTTPS address.
? A placeholder in a SQL query for SQLite and MySQL. The value is sent separately, so it can never change the query.
Access-Control-Allow-Credentials A CORS header that lets cookies go with cross-origin reads. Never pair it with a reflected or * origin.
Access-Control-Allow-Headers A CORS header in a preflight answer listing the request headers another origin may send.
Access-Control-Allow-Methods A CORS header in a preflight answer listing the methods another origin may use.
Access-Control-Allow-Origin A CORS header naming the one origin that may read the answer.
Access-Control-Allow-Origin: * Lets any site read the answer. Fine for public data, and it never carries cookies.
ALLOW-FROM An old X-Frame-Options value that modern browsers ignore. Use frame-ancestors instead.
allowlist A fixed list of accepted values, such as exact origins or sort columns. Anything else is refused.
argon2id A modern slow password hash, the first choice for new sites.
audit A check of a whole site against a list, with each problem and its fix written down.
authenticator app An app that makes a fresh six-digit code every 30 seconds for two-step sign-in.
bcrypt A slow, salted password hash. Use a cost of 10 or more.
bot An automated program that tries the same attacks on millions of sites.
breached password check Refuses passwords that appear in known leaks when a member joins or changes password.
clickjacking Hiding your page in an invisible frame so a visitor clicks your buttons without knowing.
Content-Security-Policy A header that tells the browser which sources of script and other content it may use.
Content-Security-Policy-Report-Only Tries a policy by reporting what it would block, without blocking anything.
CORS Cross-origin resource sharing: headers that let chosen origins read your API's answers.
credential stuffing Trying usernames and passwords leaked from one site on another site.
cross-site scripting (XSS) An attack where a stranger's script runs in your visitors' browsers on your page.
CSRF Cross-site request forgery: another site makes a signed-in visitor's browser send a request.
CSRF token A secret value in each form that the server checks, so forged forms fail.
default-src The CSP fallback for any content type that has no rule of its own.
dependency A package your site uses that someone else wrote.
DOM XSS XSS that happens when page script writes visitor text into the page as HTML.
dotenv A package that loads .env into process.env when your app starts.
.env A file that holds keys and passwords outside your code. Read it with process.env.
escapeHtml() Turns < > & and quotes into harmless text before visitor input goes into HTML.
escaping Turning characters with special meaning into harmless text where a value enters a page.
express-rate-limit An Express package that limits how many requests one visitor can make in a time window.
express-session An Express package that stores session data and sets the session cookie.
fixation Session fixation: an attacker plants a session id and waits for you to sign in with it.
frame-ancestors A CSP rule that lists which sites may put your page in a frame. 'none' blocks all of them.
.gitignore A list of files git should never commit. Put .env in it before your first commit.
hash A one-way scramble of a password. You can check a guess against it but not reverse it.
helmet An Express package that sets a group of security headers for you.
__Host- A cookie name prefix that locks the cookie to one host and requires Secure and Path=/.
HSTS Short for Strict-Transport-Security, which makes the browser always use HTTPS for your site.
HttpOnly A cookie flag that hides the cookie from page scripts.
HTTPS HTTP over an encrypted connection, so others on the network cannot read or change traffic.
innerHTML Reads a value as HTML. Never use it for visitor text.
LIKE search Put the % signs in the value you pass to the placeholder, never inside the SQL.
made-up package A package name an AI invented. Attackers may register it with harmful code.
mixed content An HTTPS page that loads a file over plain HTTP. Browsers block or warn about it.
nonce A random value in the CSP header and on your script tags that lets only those scripts run.
npm audit Lists known holes in your installed packages and the versions that fix them.
npm audit fix Updates packages to versions that fix known holes, where it can do so safely.
Origin A request header naming the scheme, host and port of the page that sent it.
origin The scheme, host and port together, such as https://spokeandchain.example.
package-lock.json Records the exact version of every installed package.
passkey A sign-in key tied to the real site, so a fake page cannot collect it.
password manager An app that makes and fills long random passwords. Your forms should let it work.
Permissions-Policy A header that switches off browser features such as the camera or location for your pages.
placeholder A marker in a query where a value goes. The database keeps the value apart from the command.
preflight An OPTIONS request the browser sends to ask whether a cross-origin request is allowed.
process.env Where Node reads environment values such as keys loaded from .env.
rate limit A cap on attempts per minute that slows guessing bots to a crawl.
Referrer-Policy A header that controls how much of your address goes to other sites. Use strict-origin-when-cross-origin.
reflected Origin Copying the request's Origin into Access-Control-Allow-Origin, which lets any site read the answer.
reflected XSS XSS where the script comes from the address or a form and goes straight back into the page.
regenerate Issues a fresh session id at sign-in so a planted id stops working.
Report view The lab view that counts which attacks were blocked.
revoke Cancel a key with the service that issued it. Do this for any key that was pushed.
salt A random value added to each password before hashing, so equal passwords get different hashes.
same-origin rule The browser rule that stops scripts on one origin reading answers from another.
SameSite A cookie flag that controls whether the cookie goes with requests started by other sites.
SameSite=Lax Sends the cookie on links into your site but not on cross-site forms or scripts.
SameSite=None Sends the cookie on all cross-site requests. It needs Secure and usually a CSRF token.
SameSite=Strict Never sends the cookie with any request started by another site.
script-src The CSP rule that lists where scripts may load from.
secret A key, token or password that grants access. It belongs in .env, never in code.
Secure A cookie flag that sends the cookie only over HTTPS.
security advisory A public notice of a hole in certain versions of a package.
security checklist A short list of checks you run before launch and after big changes.
security header A response header that switches on a browser defence for your pages.
session What the server remembers about a signed-in visitor, found by the id in a cookie.
session cookie The cookie holding the session id. It needs HttpOnly, Secure and SameSite.
Set-Cookie The response header a server uses to give the browser a cookie and its flags.
SHA-256 A fast hash. Fine for files, far too fast for passwords.
site The registered domain and scheme. Subdomains of one site share it, unlike an origin.
SQL injection Visitor text that becomes part of a database command and changes what it does.
stored XSS XSS saved on the server, such as in a comment, that runs for everyone who views it.
Strict-Transport-Security Tells the browser to use HTTPS for your site for max-age seconds.
textContent Puts a value into the page as plain text. Use it for visitor text.
trust boundary The line where data from outside reaches your server. Check everything that crosses it.
two-step sign-in A second proof after the password, such as an app code or a passkey.
Vary: Origin Tells caches the answer depends on the Origin header. Send it with an allowlist.
X-Content-Type-Options: nosniff Stops the browser guessing a file's type from its contents.
X-Frame-Options An older header against framing. Use DENY or SAMEORIGIN alongside frame-ancestors.
X-Powered-By A header that names your server software. Turn it off with app.disable('x-powered-by').
X-XSS-Protection An outdated header. Browsers no longer use it, so drop it.