Words about your website
Domain — your web address, like example.com. You buy it from a registrar and point it at wherever your site is hosted.
DNS — the phone book of the internet. It turns your web address into the number of the machine your site runs on. When we ask you to add a 'TXT record', we are asking you to write a short note in your entry of that phone book, which proves you control it.
HTTPS — the padlock in the address bar. It scrambles what visitors send you so nobody in between can read it. A site without it sends passwords in plain view.
TLS certificate — the file that makes the padlock work. It expires, and if it lapses every visitor gets a warning that your site is unsafe.
Header — a short instruction your site sends the browser alongside each page, telling it how to behave. Several of the checks here are about headers you should be sending and are not.
Cookie — a small note the browser keeps for your site, usually to remember that someone is logged in. If a cookie is not locked down, stealing it means becoming that user.
Words about attacks
Vulnerability — a weak spot. Something about how your site is built or configured that someone could take advantage of.
Exploit — actually using a weak spot to do something you did not intend. Finding a weak spot and exploiting it are different things, which is the difference between our normal checks and Active Pentest.
Injection — tricking your system into treating something a visitor typed as an instruction rather than as text. This is the root of several of the most serious problems, including SQL injection, where the instruction reaches your database.
Cross-site scripting, or XSS — getting your own code to run inside another visitor's browser on your site. Usually used to steal the session that keeps them logged in.
Phishing — a fake page or email that impersonates you to collect your customers' passwords. Some of the checks here are about not making that easier.
Brute force — simply trying passwords over and over until one works. Rate limiting is what stops it.
Words about protection
Authentication — proving who you are. Usually a password, ideally with a second step.
Authorization — what you are allowed to do once you are in. Most 'one customer can see another customer's data' problems are authorization problems, not authentication ones.
Rate limiting — capping how many times something can be tried in a period. It is what turns 'an attacker can try every password' into 'an attacker gets five goes'.
Firewall, or WAF — a filter in front of your site that blocks obviously malicious requests before they arrive.
Encryption — scrambling data so it is unreadable without the key. HTTPS encrypts data in transit; other checks look at whether data is encrypted where it is stored.
Words about testing
Scan — an automated look at your site for known weak spots. Safe to run repeatedly. This is what most of BreakMesh does.
Penetration test, or pentest — going further and actually trying the attacks, to prove which weak spots are real. Traditionally done by a person over days or weeks; ours is done by software inside limits you set in advance.
Non-destructive — a check that only looks, and never deletes, changes or overloads anything. All our standard checks are non-destructive.
False positive — something reported as a problem that turns out not to be one. Every scanner produces some; we show you the evidence so you can judge.
Severity — how bad a finding is, from low to critical. It reflects what an attacker could do with it, not how hard it is to fix.
Remediation — the fix. Every finding here comes with one.
Words about paperwork
SOC 2 — a standard big customers and auditors use to ask how you handle security. Our reports sort your results into the categories it asks about.
Statement of Work, or SOW — a short written agreement setting out what will be tested and for how long. Required before the more forceful tests run, so the boundaries are agreed in writing rather than assumed.
Rules of Engagement — the limits inside that agreement: what is in scope, what is off limits, and when testing may happen.
Data Processing Agreement, or DPA — a contract about how a supplier handles your data. Customers in Europe usually ask for one. We have one available.
Evidence — the proof behind a finding: the exact request we sent and what your site sent back. It is what lets an engineer reproduce and fix the issue, and what an auditor wants to see.