Get the terminology right.
Twenty-four useful definitions for scanner integrations, model evaluation, code and file review, and image intelligence.
Scanner API
An interface through which an application requests an inspection and retrieves its results. It describes how a scanning workflow is exposed, not the particular type of object being inspected. The API may support files, prompts, repositories, or other defined inputs.
Explore the related guideAPI scanner
A tool or workflow used to assess an application interface. It may examine endpoints, validation, authentication, or authorization within an explicitly permitted scope. This is different from using an API to request a file scan.
Explore the related guideScan job
A tracked unit of inspection work associated with a specific subject and requested checks. A useful job record distinguishes acceptance, processing progress, completion, and any application decision that follows.
Explore the related guideIdempotency
A property or application contract that controls the effect of repeated operations. In a proposed scan interface, a scoped idempotency key can associate a retry with existing work instead of creating another job, provided the contract defines matching and conflicting requests.
Explore the related guideCoverage
A description of what the inspection actually examined. Coverage may be incomplete because of unsupported content, missing inputs, restricted scope, time limits, or processing failures. It should remain separate from the findings produced by the completed checks.
Explore the related guidePolicy decision
The application’s choice of release, hold, rejection, or review based on available evidence and a defined rule. The decision is not the same thing as an engine result, and an override should not rewrite the underlying evidence.
Explore the related guideFalse positive
A case incorrectly classified as belonging to a category of concern under the evaluation’s labeling rules. Its cost depends on the workflow: it may create a review task, delay a document, or block legitimate work.
Explore the related guideFalse negative
A case that belongs to the evaluated category but is not identified as such. Interpretation depends on representative data and clear category definitions, rather than an isolated example or an overall accuracy headline.
Explore the related guidePrecision
For a defined positive category, the proportion of positive predictions that are correct in the evaluated dataset. Keep the supporting counts and labeling process visible; a percentage alone does not describe the operating conditions.
Explore the related guideRecall
For a defined positive category, the proportion of actual positive cases that the system identifies in the evaluated dataset. It answers a different question from precision and should be interpreted with the data and test scope.
Explore the related guidePrompt injection
Untrusted input that influences a language-model application to behave in an unintended way. Review should consider both direct user content and indirect sources such as retrieved documents, while keeping tool permissions enforced by the application.
Explore the related guideTrust boundary
A point where content, authority, or access crosses between components with different assumptions. In an LLM workflow, retrieved text and proposed tool actions deserve separate scrutiny because the source author should not automatically gain control over the action.
Explore the related guideLeast privilege
A design principle that limits an identity or component to the access needed for its intended role. In an inspection or LLM workflow, narrow capabilities can limit the effect of a missed detection or unexpected request.
Explore the related guideSecret scanning
Inspection for exposed credentials or other defined sensitive values in a repository or related material. Finding a value starts a credential-response process; removing the string from the current file does not independently revoke it.
Explore the related guideStatic analysis
Inspection of program structure or content without treating a live production interaction as the primary evidence. Results need the relevant code version and configuration, and may require developer review to establish how a reported pattern is used.
Explore the related guideDependency review
Examination of packages, resolved versions, and their relationship to an application. A useful review keeps direct and transitive dependencies identifiable and distinguishes an advisory match from a demonstrated runtime impact.
Explore the related guideSignature database
The detection data used by an engine to recognize supported patterns. Operational review should distinguish whether the data was updated and whether the intended engine actually loaded it for an inspection.
Explore the related guideQuarantine
A restricted holding state for an object awaiting a release decision or retained for authorized review. A label alone is not enough: storage and delivery paths must prevent access that the application’s policy has not approved.
Explore the related guideNo detection
A completed check did not report a detection within its actual scope. The phrase does not establish that every relevant threat was examined, and it should not be used for a failed, skipped, or unsupported inspection.
Explore the related guideHash lookup
A request for existing information associated with a content digest. It can provide useful context about known bytes, but an unknown digest does not constitute a new file analysis or a favorable verdict.
Explore the related guideContent-type validation
A check of the file format or media type used in the upload policy. Client-supplied labels and names should be compared with appropriate content inspection rather than treated as an authoritative description of the bytes.
Explore the related guideVisual similarity
A relationship between images based on visual features within a defined collection or service. Similarity can support discovery without establishing identical content, shared origin, authenticity, or the identity of a depicted person.
Explore the related guideEXIF
A metadata format associated with image files. Supported fields may describe camera settings, time-related information, or location, depending on the file and its history. EXIF is not the only metadata format an image workflow may need to inspect.
Explore the related guideProvenance
Information about where an artifact or observation came from and how it was handled. For a scan, preserve the subject, source, relevant versions, and transformations so a reviewer can trace a conclusion back to its supporting evidence.
Explore the related guideThese concise explanations support the library’s workflows. For tool-specific field names and protocol behavior, consult the primary source library and the documentation for the selected provider.