GitHubSubmit a correctionCorrection

Glossary

The vocabulary of code quality, security and code review

58 terms, each defined plainly and linked to the tools in the directory that actually support it.

Showing 58 of 58 terms

Developer workflowAI Agent GuardrailsChecking code from AI coding agents while it is being written, through an MCP server, agent hooks or a plugin.16 toolsAI capabilitiesAI Code GovernanceTracking and setting policy over AI-generated code entering your codebase.4 toolsAI capabilitiesAI Code ReviewUsing a language model to review changes contextually, rather than matching them against fixed rules.20 toolsTool categoriesAI Coding AgentA general-purpose AI coding agent that writes and edits code, with review or security scanning as one capability among many.3 toolsAI review & fixesAI Logic Bug DetectionUsing an AI model to find bugs that no fixed rule describes, such as off-by-one errors, inverted conditions, the wrong variable used or broken business logic.17 toolsAI review & fixesAI Triage (False-Positive Filtering)Using a model to assess which raw findings are real and worth acting on, and suppressing or deprioritizing the rest.18 toolsDeploymentAir-Gapped (Offline) DeploymentRunning the tool fully offline, with no internet connection at all, in an environment physically isolated from outside networks.9 toolsCode qualityArchitecture GovernanceEnforcing structural rules about which parts of a codebase are allowed to depend on which others.8 toolsSecurity & complianceAudit LogsAn immutable record of who did what in the tool, such as settings changed, findings dismissed or gates bypassed.19 toolsAI review & fixesAutofix Pull RequestsThe tool opens its own pull request containing a fix, rather than suggesting an edit inside yours.16 toolsAI review & fixesAutofix SuggestionsProposing a concrete code change that resolves a finding, usually as a one-click suggestion in the pull request.20 toolsCode qualityBehavioral Code AnalysisUsing version-control history, not just the current code, to find hotspots, coupling and delivery risk.10 toolsAI capabilitiesBring Your Own ModelPointing the tool at your own model deployment or LLM API key instead of the vendor's hosted inference.11 toolsAutomation & accessCLICommand-line interface: a client you run from a terminal or a script to start scans and pull results, in any environment.19 toolsDeploymentCloud (SaaS) DeploymentThe vendor hosts and operates the tool; your code is analyzed on their infrastructure.20 toolsAI capabilitiesCode Excluded From TrainingA vendor's documented commitment that your source code is not used to train its own or a third party's models.19 toolsTool categoriesCode Quality PlatformA code quality product centered on maintainability, code smells, complexity, duplication and test coverage, usually with security scanning layered on.5 toolsTool categoriesCode Security PlatformA consolidated code security product that covers several scanning types, typically SAST, SCA, secrets, IaC and containers, under one risk model.7 toolsCode qualityCode Smell DetectionFlagging code that works but will be expensive to maintain, such as long methods, deep nesting, poor naming and structural anti-patterns.19 toolsCode qualityComplexity MetricsMeasuring how convoluted code is, typically cyclomatic or cognitive complexity per function.9 toolsSecurity & complianceCompliance Reporting & ExportsGenerating evidence for auditors: control coverage, scan history, finding status mapped to a framework.16 toolsSecurity scanningContainer ScanningInspecting container images for vulnerable OS packages, application dependencies and unsafe build practices.12 toolsAI capabilitiesConversational ReviewReplying to the tool's findings conversationally to ask why, push back, or request an alternative fix.17 toolsSecurity scanningCSPMCloud Security Posture Management: continuously auditing live cloud accounts for misconfiguration and policy drift.4 toolsRules & repo supportCustom Rule AuthoringWriting your own analysis rules for conventions, internal frameworks or organization-specific risks.19 toolsSecurity scanningDASTDynamic Application Security Testing: probing a running application from the outside, the way an attacker would.7 toolsCode qualityDead Code DetectionIdentifying code that is never reached or referenced, such as unused functions, unreachable branches and orphaned files.6 toolsCode qualityDiff Coverage (New Code)Measuring coverage only on the lines changed in a pull request, rather than across the whole codebase.5 toolsCode qualityDuplication DetectionFinding copy-pasted or near-identical code blocks across a codebase.10 toolsDeveloper workflowFull Repo ScanAnalyzing an entire repository rather than only the diff, establishing a complete baseline.19 toolsSecurity scanningIaC ScanningChecking infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles) for insecure configuration before it is applied.13 toolsDeveloper workflowInline PR CommentsPosting findings as comments on the specific lines of a pull request, rather than in a separate dashboard.20 toolsAI capabilitiesLearning From FeedbackAdapting future findings based on which comments your team accepted, fixed or dismissed.16 toolsSecurity scanningLicense ComplianceIdentifying the licenses of your dependencies and flagging ones that conflict with your policy.12 toolsDeveloper workflowLocal Analysis (Pre-Commit)Running the analysis itself on a developer's machine, from the command line or a git hook, without waiting for CI.20 toolsSecurity scanningMalicious Package DetectionCatching deliberately hostile dependencies: typosquats, packages published from hijacked maintainer accounts, and packages that run malicious code when installed.8 toolsAI capabilitiesMCP ServerExposing the tool's capabilities over Model Context Protocol so AI agents can call it directly.18 toolsRules & repo supportMonorepo SupportHandling a repository containing many projects: per-directory configuration, ownership and scoped analysis.18 toolsTool categoriesPR Review ToolA tool whose primary surface is the pull request: it reads the diff in context and leaves review comments, usually AI-generated.5 toolsAI review & fixesPR Summaries & WalkthroughsAutomatically generated descriptions of what a pull request changes, sometimes with a guided file-by-file walkthrough.14 toolsDeveloper workflowQuality Gates (Merge Blocking)Preventing a pull request from merging while it violates a defined quality or security threshold.18 toolsSecurity scanningReachability AnalysisDetermining whether your code actually calls the vulnerable function inside a flagged dependency.10 toolsDeveloper workflowReal-Time IDE FeedbackSurfacing findings inside the editor as code is written, before anything is committed.18 toolsAutomation & accessREST APIProgrammatic access to findings, configuration and scan results over HTTP.19 toolsSecurity & complianceRole-Based Access ControlControlling what each user can see and change through defined roles rather than blanket access.20 toolsDeveloper workflowRuntime MonitoringObserving the application in production to detect or block attacks and confirm which vulnerabilities are actually exposed.6 toolsSecurity scanningSASTStatic Application Security Testing: analyzing source code for security flaws without running it.19 toolsSecurity scanningSBOM GenerationProducing a machine-readable inventory of everything in a build, usually in CycloneDX or SPDX format.11 toolsSecurity scanningSCASoftware Composition Analysis: identifying third-party dependencies and matching them against known vulnerability databases.16 toolsDeveloper workflowScheduled RescansRe-analyzing code on a schedule even when nothing has changed, to catch newly published vulnerabilities.19 toolsSecurity scanningSecrets DetectionFinding credentials (API keys, tokens, private keys, connection strings) committed to code, config files or git history.16 toolsSecurity scanningSecrets ValidationChecking whether a detected secret is actually live, usually by calling the provider, instead of just reporting that it looks like a key.6 toolsDeploymentSelf-Hosted (On-Premises) DeploymentRunning the tool on infrastructure you control, so source code never leaves your environment.16 toolsSecurity & complianceSSO (SAML)Authenticating users through your identity provider rather than tool-specific credentials.19 toolsSecurity scanningTaint Analysis (Data-Flow)Tracing untrusted input from where it enters the program (source) to where it could do damage (sink).10 toolsCode qualityTechnical Debt QuantificationExpressing accumulated code quality problems as an estimated cost, typically remediation time or a letter grade.7 toolsCode qualityTest Coverage TrackingIngesting coverage reports from your test runs and tracking which lines are exercised by tests.7 toolsAutomation & accessWebhooksOutbound HTTP callbacks that notify your systems when a scan completes or a finding appears.19 tools