Glossary

Learn common terms for JFrog Security concepts, features, and workflows.

This glossary defines common terms used across JFrog Security products and documentation. You can use it as a reference when exploring security concepts, features, and workflows across the JFrog Platform.

A

JFrog Advanced Security

JFrog Advanced Security is a set of enhanced security capabilities that extend beyond traditional vulnerability scanning to provide deeper risk analysis and prioritization, such as secrets detection, infrastructure-as-code scanning, and contextual vulnerability analysis.

Artifact

An artifact is a binary output produced by a build process, such as a package, container image, or archive, that JFrog Artifactory stores and manages. JFrog Security scans artifacts to identify security, license, and operational risks.

Aggregated SBOM

An aggregated software bill of materials (SBOM) is an SBOM that combines component information from multiple artifacts or builds.

B

Build

A build is a logical representation of a CI/CD process that produces one or more artifacts. Builds provide context for understanding security, license, and operational risk across all included components.

Build Stability

Build stability is an indication of how reliable and reproducible a build is over time based on its dependencies and configuration.

C

JFrog Catalog

JFrog Catalog is a centralized view of packages and components used across an organization, enabling visibility, governance, and policy-based control.

Component

A component is an individual software unit within an artifact or package, such as a dependency or library version, that is evaluated during security and license analysis.

Compliant Version

A compliant version is a package version that satisfies defined security and license policies.

Contextual CVE Analysis

Contextual common vulnerabilities and exposures (CVE) analysis is the prioritization of vulnerabilities based on contextual factors such as reachability, exploitability, and actual usage within an application.

Custom Software License

A custom software license is a user-defined license that represents proprietary or non-standard license terms not included in common license databases.

CVE

A Contextual common vulnerabilities and exposures (CVE) is a publicly disclosed security vulnerability assigned a unique identifier.

D

Dependency

A dependency is a third-party package or library that an application relies on.

Direct Dependency

A direct dependency is a dependency explicitly declared by an application.

Transitive Dependency

A transitive dependency is a dependency introduced indirectly through another dependency.

E

Enforcement

Enforcement is the process of applying policies at defined control points to prevent or manage risk.

Enforcement Action

An enforcement action is the outcome when a policy violation occurs, such as blocking a download, failing a build, or generating a notification.

Enforcement Point

An enforcement point is a stage in the software lifecycle where policies are evaluated, such as dependency resolution, build promotion, artifact download, or runtime execution.

Exploitation Attempt

An exploitation attempt is an attempt to take advantage of a vulnerability or weakness in a running application.

F

False Positive

A false positive is a reported security issue that doesn't pose an actual risk.

Fix Recommendation

A fix recommendation is guidance provided to help developers remediate identified security issues.

I

Indexing

Indexing is the process of extracting and storing metadata from artifacts, packages, or SBOMs so you can scan and analyze them efficiently for risk.

Ignore Rule

An ignore rule is a rule that suppresses specific policy violations for a defined scope, so you can manage known or accepted risks without blocking workflows.

Infrastructure as Code

Infrastructure as Code (IaC) refers to configuration files used to define and provision infrastructure, such as Terraform or Kubernetes manifests.

J

JFrog Security Research

JFrog Security Research is JFrog’s internal research effort that continuously analyzes open-source ecosystems to identify vulnerabilities, malicious activity, and emerging supply chain threats.

L

Label

A label is a metadata tag assigned to packages or components to classify them for governance, policy enforcement, or visibility purposes.

Public Label

A public label is a predefined label provided by JFrog to classify packages based on curated criteria.

Private Label

A private label is a user-defined label created by an organization to support custom governance or policy workflows.

License

A license is a set of legal terms that define how a software component can be used, modified, and distributed.

License Attribution Report

A license attribution report is a report that lists license information for components included in an artifact or build, typically required for compliance and redistribution.

License Conclusion

A license conclusion is the effective license for a component based on its contents and dependencies.

License Violation

A license violation is an event that occurs when a component or artifact doesn't comply with defined license policies.

M

Malicious Package

A malicious package is a package that contains intentionally harmful code or behavior, such as credential exfiltration, cryptomining, or backdoors.

Malicious Package Detection

Malicious package detection is a capability that identifies malicious packages based on behavioral analysis and ecosystem signals, beyond known vulnerabilities.

Malicious AI Model

A malicious AI model is an AI or machine learning model that contains unsafe behavior, hidden backdoors, or other malicious characteristics.

Misconfiguration

A misconfiguration is an insecure or incorrect configuration that could lead to vulnerabilities or operational issues.

O

Operational Risk

Operational risk is the risk that affects the reliability, maintainability, or long-term viability of software components, beyond vulnerabilities and licenses.

Outdated Dependency

An outdated dependency is a dependency that is significantly behind the latest available or recommended version.

On-Demand Scan

An on-demand scan is a scan that you trigger manually rather than a scan that an event or workflow starts automatically.

P

Package

A package is a distributable unit of software published to a package ecosystem, such as npm, PyPI, Maven, or Docker.

Pending Catalog

Pending catalog is a temporary state where a package has been detected but not yet fully processed or available for governance actions.

Policy

A policy is a set of rules that define acceptable security, license, or operational conditions.

Policy Condition

A policy condition is a specific rule within a policy that evaluates a characteristic such as a vulnerability, license type, or operational risk indicator.

Policy Scope

Policy scope is the set of resources to which a policy applies, such as repositories, builds, packages, or projects.

Policy Violation

A policy violation is an event that occurs when a policy condition isn't met.

R

Reachability Analysis

Reachability analysis is an assessment of whether vulnerable code paths are actually reachable and exploitable within an application.

Repository

A repository is a storage location in Artifactory that hosts and manages artifacts and packages.

Runtime Security

Runtime security refers to security capabilities that monitor running applications to detect suspicious behavior and exploitation attempts in production environments.

Runtime Alert

A runtime alert is a notification generated in response to suspicious or policy-violating runtime behavior.

S

Scan

A scan is the process of evaluating artifacts, builds, source code, packages, or SBOMs to identify security, license, or operational risks.

Scan Scope

Scan scope is the set of resources included in a scan, such as a specific artifact, build, repository, project, or SBOM.

Scan Type

Scan type is the category of scan, such as software composition analysis (SCA), static application security testing (SAST), secrets detection, and IaC scan.

Scan Status

Scan status is the current state of a scan, such as pending, running, completed, or failed.

Scan Result

A scan result is the output of a scan, including detected vulnerabilities, license issues, malicious indicators, and policy violations.

SBOM

An SBOM is a structured inventory of software components and dependencies that make up an artifact or application.

SBOM Enrichment

SBOM enrichment is the process of augmenting an SBOM with additional data such as vulnerabilities, licenses, and risk metadata.

SBOM Import

SBOM import is the process of uploading an externally generated SBOM into the JFrog Platform for analysis and enrichment.

SBOM Export

SBOM export is the process of generating and downloading an SBOM from the JFrog Platform.

SCA

SCA is the analysis of third-party components to identify security, license, and operational risks.

Secrets Detection

Secrets detection is the identification of exposed credentials, tokens, or sensitive information embedded in code or configuration files.

Source Code Security

Source code security is the analysis of first-party source code to identify vulnerabilities early in the development lifecycle.

Static Application Security Testing

SAST is a method of analyzing source code to detect security vulnerabilities without executing the application.

V

Violation

A violation is a detected instance where a policy condition isn't met.

W

Waiver

A waiver is a temporary or scoped exception that allows you to accept a policy violation under defined conditions without changing the policy itself.

Waiver Request

A waiver request is a request you submit to approve an exception for a specific policy violation.

Watch

A watch is a mechanism in JFrog Xray that scopes policies to specific repositories, artifacts, or builds.

X

Xray

Xray is JFrog’s security analysis engine that scans artifacts, builds, and dependencies for security, license, and operational risks.