Glossary

The vocabulary of code quality, security and review

58 terms, each defined plainly and linked to the tools in the directory that actually support it.

Showing 58 of 58 terms

Tool categoriesAgent Coding ToolA general-purpose AI coding agent that writes and edits code, with review or security scanning as one capability among many.3 toolsDeveloper workflowAI Agent Guardrails (MCP)Exposing analysis to AI coding agents, usually over Model Context Protocol, so generated code is checked as it is produced.16 toolsAI capabilitiesAI Code ReviewUsing a language model to review changes contextually, rather than matching them against fixed rules.20 toolsAnalysis & detectionAI Logic Bug DetectionUsing a model to find bugs that are not pattern-matchable, such as off-by-one errors, inverted conditions, wrong variable, broken business logic.17 toolsAnalysis & detectionAI Triage / False-Positive FilteringUsing a model to assess which raw findings are real and worth acting on, and suppressing or deprioritising the rest.18 toolsAI capabilitiesAI Usage GovernanceTracking and setting policy over AI-generated code entering your codebase.4 toolsDeploymentAir-GappedRunning with no outbound network access at all, in an environment physically isolated from the internet.8 toolsAnalysis & detectionArchitecture GovernanceEnforcing structural rules about which parts of a codebase are allowed to depend on which others.8 toolsSecurity & complianceAudit LogsAn immutable record of who did what in the tool, such as settings changed, findings dismissed, gates bypassed.20 toolsAnalysis & detectionAutofix SuggestionsProposing a concrete code change that resolves a finding, usually as a one-click suggestion in the pull request.20 toolsAnalysis & detectionAutofix via Agentic PRsThe tool opens its own pull request containing a fix, rather than suggesting an edit inside yours.16 toolsAnalysis & detectionBehavioral Code AnalysisUsing version-control history, not just the current code, to find hotspots, coupling and delivery risk.10 toolsAI capabilitiesBYO Model / BYOKPointing the tool at your own model deployment or API key instead of the vendor's hosted inference.11 toolsAI capabilitiesChat With ReviewerReplying to the tool's findings conversationally to ask why, push back, or request an alternative fix.17 toolsAutomation & accessCLIA command-line client for running scans and pulling results from any environment.19 toolsDeploymentCloud / SaaSThe vendor hosts and operates the tool; your code is analysed on their infrastructure.20 toolsAnalysis & detectionCloud Posture (CSPM)Continuously auditing live cloud accounts for misconfiguration and policy drift.4 toolsAI capabilitiesCode Excluded From TrainingA contractual and technical guarantee that your source code is not used to train the vendor's or a third party's models.19 toolsTool categoriesCode Security PlatformA consolidated code security product that covers several scanning types, typically SAST, SCA, secrets, IaC and containers, under one risk model.7 toolsAnalysis & detectionCode Smells & MaintainabilityFlagging code that works but will be expensive to maintain, such as long methods, deep nesting, poor naming, structural anti-patterns.18 toolsAnalysis & detectionComplexity MetricsMeasuring how convoluted code is, typically cyclomatic or cognitive complexity per function.8 toolsSecurity & complianceCompliance Reporting & ExportsGenerating evidence for auditors: control coverage, scan history, finding status mapped to a framework.16 toolsAnalysis & detectionContainer ScanningInspecting container images for vulnerable OS packages, application dependencies and unsafe build practices.12 toolsAnalysis & detectionCustom Rule AuthoringWriting your own analysis rules for conventions, internal frameworks or organisation-specific risks.19 toolsAnalysis & detectionDASTDynamic Application Security Testing: probing a running application from the outside, the way an attacker would.7 toolsAnalysis & detectionDead / Unused CodeIdentifying code that is never reached or referenced, such as unused functions, unreachable branches, orphaned files.6 toolsAnalysis & detectionDiff / New-Code CoverageMeasuring coverage only on the lines changed in a pull request, rather than across the whole codebase.4 toolsAnalysis & detectionDuplication DetectionFinding copy-pasted or near-identical code blocks across a codebase.9 toolsDeveloper workflowFull Repo ScanAnalysing an entire repository rather than only the diff, establishing a complete baseline.19 toolsAnalysis & detectionIaC ScanningChecking infrastructure-as-code, such as Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, for insecure configuration before it is applied.13 toolsAI capabilitiesLearns From FeedbackAdapting future findings based on which comments your team accepted, fixed or dismissed.16 toolsAnalysis & detectionLicense ComplianceIdentifying the licences of your dependencies and flagging ones that conflict with your policy.12 toolsDeveloper workflowLocal CLI / Pre-CommitRunning the same analysis locally from the command line or a git hook, without waiting for CI.20 toolsAnalysis & detectionMalicious Package DetectionCatching deliberately hostile dependencies, such as typosquats, hijacked maintainer accounts, packages with install-time payloads.8 toolsAI capabilitiesMCP ServerExposing the tool's capabilities over Model Context Protocol so AI agents can call it directly.18 toolsDeveloper workflowMerge Gate / BlockingPreventing a pull request from merging while it violates a defined quality or security threshold.18 toolsAnalysis & detectionMonorepo SupportHandling a repository containing many projects: per-directory configuration, ownership and scoped analysis.18 toolsDeveloper workflowPR Inline ReviewPosting findings as comments on the specific lines of a pull request, rather than in a separate dashboard.20 toolsTool categoriesPR Review ToolA tool whose primary surface is the pull request: it reads the diff in context and leaves review comments, usually AI-generated.5 toolsAnalysis & detectionPR Summaries & WalkthroughsAutomatically generated descriptions of what a pull request changes, sometimes with a guided file-by-file walkthrough.14 toolsTool categoriesQuality PlatformA code quality product centred on maintainability, code smells, complexity, duplication and test coverage, usually with security scanning layered on.5 toolsAnalysis & detectionReachability AnalysisDetermining whether your code actually calls the vulnerable function inside a flagged dependency.10 toolsDeveloper workflowReal-Time IDE FeedbackSurfacing findings inside the editor as code is written, before anything is committed.18 toolsAutomation & accessREST APIProgrammatic access to findings, configuration and scan results over HTTP.19 toolsSecurity & complianceRole-Based Access ControlControlling what each user can see and change through defined roles rather than blanket access.20 toolsDeveloper workflowRuntime / Production MonitoringObserving the application in production to detect or block attacks and confirm which vulnerabilities are actually exposed.6 toolsAnalysis & detectionSASTStatic Application Security Testing: analysing source code for security flaws without running it.19 toolsAnalysis & detectionSBOM GenerationProducing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.11 toolsAnalysis & detectionSCA (Software Composition Analysis)Identifying third-party dependencies and matching them against known vulnerability databases.16 toolsDeveloper workflowScheduled / Continuous RescanRe-analysing code on a schedule even when nothing has changed, to catch newly published vulnerabilities.19 toolsAnalysis & detectionSecrets DetectionFinding credentials, such as API keys, tokens, private keys, connection strings, committed into code, config or history.16 toolsAnalysis & detectionSecrets ValidationChecking whether a detected secret is actually live, usually by calling the provider, instead of just reporting that it looks like a key.6 toolsDeploymentSelf-Hosted / On-PremisesRunning the tool on infrastructure you control, so source code never leaves your environment.16 toolsSecurity & complianceSSO / SAMLAuthenticating users through your identity provider rather than tool-specific credentials.18 toolsAnalysis & detectionTaint / Data-Flow AnalysisTracing untrusted input from where it enters the program (source) to where it could do damage (sink).10 toolsAnalysis & detectionTechnical Debt QuantificationExpressing accumulated code quality problems as an estimated cost, typically remediation time or a letter grade.7 toolsAnalysis & detectionTest Coverage TrackingIngesting coverage reports from your test runs and tracking which lines are exercised by tests.6 toolsAutomation & accessWebhooksOutbound HTTP callbacks that notify your systems when a scan completes or a finding appears.19 tools