Here are terms and concepts used by Bridge CLI and the various Black Duck programs with which it interfaces.
| Term | Definition |
|---|---|
| Application | The software security tool used to scan code. |
| Application Security | Application security is enhancing software features to functionality to prevent security threats. These include denial of service attacks, unauthorized data access, privilege escalation attacks, etc. Application security is one of several levels of security used to protect systems. |
| BDSA | Black Duck® SCA Security Advisory, highly detailed open source vulnerability records that are hand-crafted by the Black Duck Cybersecurity Research Center (CyRC) |
| Black Duck | Application security testing platform that identifies open source components and vulnerabilities. |
| Branch Protection | GitHub feature that enforces rules on branches, such as requiring reviews before merging. |
| Black Duck® SCA | Software composition analysis (SCA) security scanning tool. Helps manage the security, quality, and license compliance risks of open source and third-party code in applications and containers. Bridge integrates with Black Duck® SCA. |
| CI/CD | Continuous Integration/Continuous Deployment, the process by which new checked-in code is automatically built, checked for security issues, and packaged for deployment. |
| CLI | Command Line Interface |
| Coverity | Static analysis scanning tool (SAST), which scans source code for security flaws and coding standards compliance. Bridge does not integrate with Coverity, but does integrate with Coverity Connect and CNC. |
| Coverity Connect | A web-based platform for Coverity. Bridge supports Coverity Connect. |
| Coverity cloud deployment | A cloud-native version of Coverity. Bridge supports Coverity cloud deployment, and every place in this manual that references "Coverity Connect" also applies to Coverity cloud deployment. |
| CVE | Common Vulnerabilities and Exposures. A database of publicly identified, defined, and cataloged cybersecurity vulnerabilities. |
| EULM | End User License Management agreement |
| GUI | Graphical User Interface |
| GitHub App | GitHub feature that enforces rules on branches, such as requiring reviews before merging. |
| IAST | Interactive application security testing (IAST) solutions help organizations identify and manage security risks associated with vulnerabilities discovered in running web applications by continuously analyzing all application interactions initiated by manual and/or automated tests to identify vulnerabilities in real time. |
| License Compliance | Process of ensuring open source components comply with license requirements. |
| Polaris | Polaris is a cloud-native application security testing solution that provides both best-in-class SAST and SCA, making it easier to manage application security testing. Bridge integrates with Polaris. |
| OAuth | Open standard for access delegation, allowing secure authorization without sharing credentials. |
| Organization | GitHub entity that can own multiple repositories and manage team access. |
| Pull Request (PR) | Mechanism for proposing changes to a repository and requesting review before merging. |
| Rapid Scan Static (Sigma) | Rapid Scan Static using the Sigma engine is a headless Static Application Security Testing (SAST) scanner. |
| Repository | Git repository hosted on GitHub containing source code and project files. |
| RSQL | REST Query Language |
| Runner | An application that runs a pipeline job from a CI/CD platform like GitHub or GitLab. |
| SaaS | Software as a Service |
| SARIF | Static Analysis Results Interchange Format, standardized format for static analysis tool outputs. |
| Secret | Encrypted environment variable stored in GitHub for secure access to sensitive information. |
| SAST | Static Analysis Security Testing (SAST), or static analysis, is a testing methodology that analyzes source code to find security vulnerabilities. SAST scans an application before the code is compiled. Coverity is a SAST tool. |
| SCA | Software Composition Analysis (SCA) is an automated process identifying open source software in a codebase to evaluate security, license compliance, and code quality. Black Duck® SCA is an SCA tool. |
| SCM | Source Code Management. This usually refers to an online CI/CD SCM repo like GitHub, GitLab or Azure DevOps, all of which Black Duck offers integrations adaptors for. |
| SRM | Software Risk Manager (formerly Code Dx) |
| Vulnerability | Security weakness in code or dependencies that could be exploited by attackers. |
| Webhook | HTTP callback that GitHub sends to external services when specific events occur. |
| Workflow | Automated process defined in GitHub Actions that runs in response to repository events. |