Words used in the playbooks

Short definitions of the terms the playbooks use. Each playbook links to its rules, and this page explains the words.

• Lab: a test in a controlled browser, not with visitors.
• Round trip: the time for a message to reach the server and come back. It is about 100 ms between the US and Europe.
• Network floor: the fastest a page can arrive at a given distance. With TLS 1.3, connection, encryption and the page itself take 3 round trips. TLS 1.2 adds one more.
• LCP and FCP: Largest and First Contentful Paint. They mark when the main content and the first content appear. Defined in the W3C Largest Contentful Paint and Paint Timing specifications.
• CLS: Cumulative Layout Shift, or how much the page jumps while it loads.
• TBT and INP: Total Blocking Time and Interaction to Next Paint. They measure how long the page ignores input. INP is built on the W3C Event Timing API.
• CI: continuous integration. A service that runs the checks on a clean machine for every change.
• Linter: a tool that reads code and flags rule breaks, such as ESLint, Pylint or PHPMD.
• Type checker: a tool that proves values have the types the code expects, such as TypeScript, mypy or PHPStan.
• Lock file: a file that pins the exact version of every dependency, so every install is the same.
• Feature flag: a setting that turns a feature on or off without a new deploy.
• DTO: data transfer object. A small typed object that carries named fields between parts of the code.
• SOLID: five design principles for code that is easy to change. They are single responsibility, open-closed, Liskov substitution, interface segregation and dependency inversion.
• DRY: don't repeat yourself. Each piece of knowledge lives in one place.
• CSP: Content Security Policy. A header that tells browsers which scripts, styles and images a page may load. Defined in W3C CSP Level 3.
• JSON-LD: structured data in a page that tells search engines and agents what the page is about. Defined in W3C JSON-LD 1.1.
• MCP: Model Context Protocol. A standard way for AI assistants to call tools on a server. Defined in the MCP specification.
• OWASP: an open project that publishes lists of the most common security risks. Its best-known list is the OWASP Top 10.
• Prompt injection: hidden instructions in text an AI model reads, written to make it disobey its owner. It is first in the OWASP Top 10 for LLM applications.
• TLS: the encryption behind HTTPS. Version 1.3 is defined in RFC 9846.
• HSTS: HTTP Strict Transport Security. A header that tells browsers to use HTTPS only. Defined in RFC 6797.
• CORS: Cross-Origin Resource Sharing. Headers that decide which other sites may read your responses. Defined in the WHATWG Fetch standard.
• SRI: Subresource Integrity. A hash on a script tag, so the browser refuses a changed file. Defined in W3C Subresource Integrity.
• CDN: content delivery network. Servers around the world that keep copies of your files close to visitors.
• DNS and DNSSEC: DNS turns a domain name into a server address. DNSSEC signs those answers so they cannot be faked. Defined in RFC 1035 and RFC 4033.
• CAA: a DNS record that lists which authorities may issue certificates for your domain. Defined in RFC 8659.
• WCAG: Web Content Accessibility Guidelines, the standard for accessible websites. Published by the W3C as WCAG 2.2.
• ARIA: attributes that tell assistive technology what an element is when HTML alone cannot. Defined in W3C WAI-ARIA 1.2.
• OAuth: a standard way to let an app or agent act for a user with a limited token instead of a password. Defined in RFC 6749, with current security advice in RFC 9700.
• JWT: JSON Web Token. A signed token that carries claims, such as who the user is. Defined in RFC 7519.
• CVSS: a scoring system from 0 to 10 for how severe a security hole is. Published by FIRST.
• SSRF: server-side request forgery. Tricking a server into fetching an address the attacker picks. See the OWASP SSRF prevention cheat sheet.
• A2A: Agent2Agent. A protocol that lets AI agents describe themselves and send each other tasks.
• YAGNI: you aren't gonna need it. Build only what is needed now.
• Law of Demeter: a function talks only to its direct neighbours, never through a chain of other objects.
• Staging: a copy of production with test data, used to try changes first.
• Migration: a versioned script that changes the database structure.
• Rollback: putting the previous release back when a new one fails.
• Branch: a separate line of work in version control.
• Diff: the lines a change adds and removes.
• Pull request: a request to merge a branch after review and checks.
• Build gate: a check in the build that stops it when a rule breaks.
• Health check: an address that answers whether the service and what it depends on work.
• Sandbox: a closed space, such as a container, where code or an agent runs without reaching anything else.
• Hook: a script an AI agent's tool runs before or after an action, which can block it.
• Idempotency key: a unique value sent with a request, so a retry never does the work twice. Described in an IETF draft.
• Webhook: a request one system sends to another when something happens.
• OpenAPI: a standard file that describes an API's addresses, inputs and outputs. Defined in the OpenAPI Specification.
• ETag: a version label on a response, used to skip unchanged downloads and to stop lost updates. Defined in RFC 9110.
• Cursor pagination: paging through a list with a pointer to the last item seen, instead of a page number.
• SLI: a measure of what users get, such as the share of fast, successful requests.
• SLO: the target for an SLI over a period.
• Error budget: how much failure the SLO still allows.
• RPO and RTO: how much data you may lose, and how long a restore may take.
• Runbook: written steps for handling one alert or task.
• On-call: the person who answers alerts at a given time.
• Postmortem: a written review after an incident, focused on causes and fixes, not blame.
• Smoke test: a few fast, read-only tests run against the live address right after a deploy.
• Burn rate: how fast the error budget is being used, compared with the pace that would use it up exactly on time.
• Load shedding: refusing extra requests quickly, so the ones already accepted still finish.
• Release cooldown: waiting some days before installing a new version of a dependency, so a hijacked one is found first.
• PKCE: Proof Key for Code Exchange. A one-time secret that ties an OAuth login's start to its end. Defined in RFC 7636.
• Pseudo-localisation: a test language that makes text longer and accented, to find text that cannot be translated.
• Value object: a small type for one domain value, such as an email address or an amount of money, that checks itself.
• End-to-end test: a test that drives the whole app the way a person does.
• Contract test: a test that checks two services still agree on the shape of their messages.
• Test double: a stand-in for a dependency in a test, such as a fake or a mock.
• Flaky test: a test that passes or fails without any change to the code.
• Mutation testing: changing the code on purpose to see whether the tests notice.
• Instructions file: a file such as AGENTS.md or CLAUDE.md that tells coding agents how to work in a repository.
• Context window: the amount of text an AI model can read at once.
• Lethal trifecta: an agent with private data, untrusted content and a way to send data out, which attackers can combine.
• Slopsquatting: attackers publishing packages under names that AI models invent.
• AI app builder: a tool such as Lovable, Bolt or Replit that builds an app from a description.
• Least privilege: giving each person, key or service only the access it needs.
• Allow list: a list of the only values that are accepted, with everything else refused.
• Passkey: a sign-in key stored on a device, which replaces a password and cannot be phished. Passkeys are built on W3C Web Authentication.
• Tenant: one customer's account and data in a system that serves many customers.
• Row-level security: database rules that limit which rows each user may read or change.
• GDPR: the EU law on personal data. The full text is on EUR-Lex.
• Canonical address: the one address a page should be known by.
• Core Web Vitals: Google's measures of loading, response and visual stability. Described in Google Search Central.
• Well-known address: a standard path under /.well-known/ where programs find a site's settings. Defined in RFC 8615.
• Schema.org: a shared vocabulary for structured data about pages, products and organisations. Published at schema.org.
• RFC: a numbered internet standard or proposal, published by the IETF. All of them are at the RFC Editor.
• SPF: a DNS record that lists the servers allowed to send a domain's email. Defined in RFC 7208.
• DKIM: a signature on each email that proves the domain sent it. Defined in RFC 6376.
• DMARC: a DNS record that tells mailbox providers what to do with mail that fails those checks. Defined in RFC 9989.
• Pre-signed URL: an address signed by your server that lets one client upload or download one file for a short time.
• Decision record: a short numbered note in the repository with one design decision, its reason, date and status.
• EXIF: metadata inside photo files, which often includes the GPS position and camera details.
• Web Push: a standard way for a site to send notifications through the browser's push service, even when the site is closed. Defined in RFC 8030 and the W3C Push API.
• APNs and FCM: Apple's and Google's services that deliver push notifications to their devices. Documented by Apple and Firebase.
• 10DLC: ordinary ten-digit US phone numbers used for business texts, which must be registered with carriers first.
• SMS pumping: fraud where bots make you send texts to premium numbers, and the fraudster shares the fees.
• E.164: the international phone number format of a plus sign, country code and number, without spaces.
• Tracking plan: the list of every analytics event, with its properties and purpose, kept in code.
• Sample ratio mismatch: an experiment's groups differ in size from the planned split, so its results cannot be trusted.
• Infrastructure as code: files in version control that describe servers, networks and DNS, which a tool turns into the live setup.
• State file: the record an infrastructure tool keeps of what it created, often holding secrets in plain text.
• Drift: a difference between the infrastructure code and what is live, usually from a change made by hand.
• OIDC federation: a pipeline or service swaps a signed identity token for short-lived cloud credentials, with no stored key.
• Break-glass account: an emergency admin login, kept offline, for when normal sign-in is down.
• Policy as code: rules about infrastructure written as checks that pass or fail automatically.
• Embedding: a list of numbers that stands for the meaning of a text, so similar texts can be found by distance.
• RAG: retrieval-augmented generation. Finding your own documents for a question and giving them to the model to answer from.
• Eval: a fixed set of graded examples that scores an AI feature, run on every prompt or model change.
• Token: the unit models read and write, about three quarters of an English word. Providers bill by the token.
• Structured output: a model mode that returns JSON matching a schema you supply.
• Design token: a named value, such as a colour or a spacing step, that every component reads instead of repeating it.
• Optimistic update: changing the screen before the server answers, and putting the old data back if the request fails.
• Error boundary: a wrapper that catches a crash in one part of the screen and shows a fallback instead.
• Visual regression test: a test that compares screenshots with approved ones and fails when the pixels change.
• SCIM: a standard API that lets a company's directory create, update and remove users in another app. Defined in RFC 7644.
• SAML: an older XML standard for single sign-on, common with business identity providers.
• RBAC and ABAC: access decided by a person's role (RBAC), or by conditions on the user, the record or the time (ABAC).
• Impersonation: a staff member viewing an account as its customer sees it, for support.
• Recovery code: a single-use code, saved at setup, that lets a person sign in when their second factor is lost.
• Account pre-hijacking: signing up with someone else's address before they do, to take over their account later.
• PSP: payment service provider. A company such as Stripe or Adyen that takes card and bank payments for you.
• PCI DSS: the card industry's security standard for anyone who takes card payments. Published by the PCI Security Standards Council.
• SCA: Strong Customer Authentication. The EU rule that people prove who they are when they pay online. Required by the PSD2 directive.
• 3-D Secure: the bank step that checks who is paying by card, used to meet SCA.
• Chargeback: a dispute where the customer's bank takes a payment back from the merchant, plus a fee.
• Dunning: retrying failed renewals and asking customers to update their payment method.
• Minor unit: the smallest unit of a currency, such as cents, used to store amounts as whole numbers.
• Reverse charge: a cross-border business sale where the buyer, not the seller, accounts for the VAT.
• E-invoice: an invoice sent as structured data, such as EN 16931 over Peppol, not as a PDF.
• Record of processing: the GDPR Article 30 list of what personal data a company processes, why, and who receives it. See the GDPR on EUR-Lex.
• DPA: data processing agreement. The contract GDPR Article 28 requires with every vendor that handles personal data for you. See the GDPR on EUR-Lex.
• Subprocessor: a vendor your processor uses to handle your customers' personal data.
• DPIA: data protection impact assessment. A written risk review required before high-risk processing. Article 35 of the GDPR sets when one is required.
• SCCs: Standard Contractual Clauses. EU-approved contract terms for sending personal data outside the EEA. Adopted in Commission Decision 2021/914.
• SOC 2: an audit report on a company's security controls. The framework is owned by the AICPA.
• ISO 27001: the international standard for managing information security.
• NIS2: the EU directive with cybersecurity duties for medium and large firms in key sectors. The full text is Directive 2022/2555.
• CRA: the EU Cyber Resilience Act. Security duties for hardware and software products sold in the EU. The full text is Regulation 2024/2847.
• AI Act: the EU law on AI systems, with duties set by risk level and by role. The full text is Regulation 2024/1689.