Find a definition, see it in a security investigation and follow the distinction that matters. Technical identifiers stay the same across languages.
16 terms shown out of 16.
A model-modification technique intended to reduce refusal behavior by changing representations associated with refusal. Its effects depend on the base model and implementation. It does not establish accuracy, expertise, security or permission to execute an action.
Treat the model’s answer as a hypothesis to inspect. The catalog identifies the underlying model; a product name does not mean NotHoly trained that base model.
The interfaces, inputs and reachable behaviors through which an actor can interact with a system. Routes, services, file parsers and identity flows can all belong to an attack surface. Exposure alone does not establish a vulnerability.
Define the feature and entry points under review, then connect each suspected weakness to a reachable operation and a security boundary.
The decision that permits an identity to perform an action on a particular resource. Authentication establishes who the caller is; authorization evaluates what that caller may do in the current context.
A report lookup should enforce the current tenant’s access rule on the server. An authenticated session or a hidden button is insufficient evidence of that check.
A failure to enforce the intended restrictions on actions or resources. Examples include crossing tenant boundaries, acting as a different role or accessing an object through a route that omits a required policy check.
Compare owner and non-owner behavior with synthetic accounts. Demonstrate the protected action or data, then test the same boundary after remediation.
The amount of tokenized material a model request can accommodate, subject to the model and service’s actual limits. Conversation history, instructions, selected context and output budgeting all affect what fits. A large context window is not a guarantee that every detail will be used correctly.
Select relevant excerpts and reserve output space. Check current catalog limits instead of assuming an advertised model maximum is available for every account or request.
Material that supports a claim and can be inspected independently: a source line, response field, file offset, recorded event or reproducible test result. A model-generated explanation is an interpretation of evidence, not a substitute for it.
Keep each conclusion linked to the supplied material or actual tool result. Record missing context and alternative explanations before assigning impact.
A result reported as a problem or malicious behavior when the relevant condition is absent. Static warnings and detection matches can become false positives when they ignore surrounding checks or ordinary administrative behavior.
Look for a counterexample and inspect the controls around a suspicious operation. Test detection rules against benign fixtures as well as expected matches.
Insecure direct object reference: an access-control flaw in which a caller can reach an object through an identifier without the required authorization. Sequential IDs can make discovery easier, but unpredictable IDs do not replace an ownership check.
Change identity while keeping the target object constant. Verify that a non-owner receives protected data or performs an action, rather than inferring a flaw from the identifier format.
An observable artifact used to investigate or detect potentially malicious activity, such as a file hash, domain or distinctive configuration value. Its usefulness depends on provenance, time and context; an embedded string alone may never have been used.
Record where an indicator came from and what it establishes. Distinguish a static candidate from a destination observed in network telemetry.
Granting an identity only the actions and resources needed for its task. The principle applies to application roles, API key scopes, storage policies and tool permissions. A broad role is not made narrow by a UI that exposes fewer buttons.
Review both allowed and denied operations. A file-reading credential should not gain unrelated deletion or administrative authority.
Instructions embedded in untrusted content that try to redirect a model away from the application or user’s intended task. Documents, retrieved pages and tool results can carry such instructions even when they appear to be ordinary evidence.
Treat source excerpts as data. Keep tool authority, secrets and approval checks outside the model’s control; a document cannot grant itself permission to run an action.
A request setting that controls the supported model’s reasoning behavior or budget according to its provider contract. Support and accepted values vary. It is separate from the response’s visible length and does not guarantee a correct answer.
Use only the effort options exposed for the selected model. Consider output and budget limits as well; unsupported values should not be silently presented as working capabilities.
The customer-facing rate used to meter eligible model usage. Input, output and cached input may have different rates. Internal supplier costs are a separate accounting value and do not define the customer’s published consumption schedule.
Use the current public rate table and estimator. Cached input replaces the matching ordinary-input charge; it is not a second charge for the same tokens.
Examining code or a file without executing the program being analyzed. Source review, binary structure inspection and disassembly can reveal possible paths and operations, but may miss runtime state, generated code or behavior hidden by packing.
Cite the function, offset or source line behind a claim. Describe possible behavior separately from events that were actually observed at runtime.
A structured description of the assets, actors, trust boundaries and failure scenarios relevant to a system. It gives a review a concrete scope and helps distinguish a plausible attack path from an assumption about a different environment.
State the actor’s starting privileges, the protected asset and the boundary under test before asking for a verification plan.
A unit of text or other supported content used by a model’s tokenizer. Tokens do not correspond to a fixed number of words or messages. Request context, generated output and cached portions can be counted and billed differently.
Measure actual usage returned by the service. A short visible answer can still involve substantial input context, and a character count is only an estimate of tokens.