Software Supply Chain Topics & Glossary | JFrog Learn
Software Supply Chain Topics
Browse by category or alphabetically, and access in-depth articles on key software supply chain topics—from languages and libraries to package managers, toolchains, and security practices.
Access Control
Access control defines and enforces who can access or modify digital resources to protect data and ensure compliance.
Agent Skills Repository
An agent skills repository is a centralized, versioned store for artificial intelligence agent capabilities that functions as a strictly...
Agentic Repository
An agentic repository is a new type of software repository that uses AI agents to automate and optimize the software delivery process.
Agentic Supply Chain
An agentic supply chain is an autonomous system where AI agents reason and execute tasks to resolve disruptions and secure software...
AI Agent Immunization
AI agent immunization is a multi-layered defense mechanism that embeds protection into an autonomous...
AI Gateway
An artificial intelligence (AI) gateway is a centralized proxy layer that manages traffic between applications and model providers to...
AI Governance
AI governance is a set of guidelines and procedures to manage AI from development to deployment to ensure it is compliant and safe for...
AI Regulatory Compliance
AI regulatory compliance is the process of ensuring AI systems meet applicable legal standards...
AI Security
AI security is the practice of protecting machine learning systems, data, and pipelines from...
AI TRiSM
AI TRiSM is a framework for governing artificial intelligence models that ensures systems remain...
AIBOM
AnAIBOM is a standardized record of artificial intelligence...
API Security
API security mitigates attackers' abuse of an Application Programming Interface to disrupt systems or steal data.
Application Security
Application security refers to the measures taken to protect software applications from threats and vulnerabilities.
Artifact Management
Artifact Management is the process of organizing and storing software binaries and their metadata to...
AST
Application Security Testing (AST) identifies, reports, and detects vulnerabilities in software applications throughout the SDLC.
Backdoor Attack
A backdoor attack is a technique used by threat actors to create a hidden entry point into an application or environment.
Build
As a verb, to compile your source code into an executable binary. As a noun, a version of your application as an executable binary.
CI/CD
CI/CD streamlines and automates the process of integrating, testing, and delivering code changes to applications.
CI/CD for Machine Learning
CI/CD for machine learning is an automated workflow that integrates and deploys model code and artifacts, enabling rapid, reliable...
Cloud Native
Cloud native is an approach to building and running software specifically designed to leverage the flexibility, scalability, and...
Cloud Native Development Acceleration
Learn the 7 essential practices that a DevOps solution must enable to accelerate your path to cloud native development.
CNAPP
A cloud-native application protection platform (CNAPP) is a consolidated security solution that unifies cloud posture and workload...
Code Signing
Code signing is a cryptographic process that uses a digital signature to confirm a software artifact’s origin and integrity.
Compiler
A compiler translates an application written in a higher-level programming language into a lower-level language so it can be executed.
Container
A virtualized operating system environment that includes an application and its dependencies, helping it run anywhere it's deployed.
Container Orchestration
Container Orchestration is an automated process that manages the lifecycle of containerized applications across a cluster of servers,...
Container Registry
A container registry is a centralized repository service for storing, managing, and distributing container images, enabling consistent...
Container Runtime Security
Container runtime security is a component of application security, helping to detect/mitigate issues that impact running containers.
Container Security
Container security is the practice of protecting containerized applications across the build, ship, and...
Containerization
Containerization is an operating system virtualization method that packages code and its dependencies into isolated units to ensure...
Continuous Delivery
Continuous delivery (CD) is a software development practice that ensures code changes are always in a deployable state.
Continuous Deployment
Like Continuous Delivery, a philosophy that your software updates should be continuously delivered to the target. However, Continuous...
Continuous Integration
Continuous integration (CI) is a software development practice where developers merge code changes into...
Contract Testing
Contract testing is a software testing methodology that evaluates interactions between individual software services to ensure they...
CSPM
Cloud environments typically include a large number of diverse workloads running across multiple cloud services, with thousands of human...
CVE
共通脆弱性識別子 (CVE) は、公開されたサイバーセキュリティの脆弱性に割り当てられた一意の識別子...
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework for rating the severity of security vulnerabilities.
Cybersecurity Maturity Model Certification (CMMC)
CMMC is a mandatory Department of Defense framework setting verifiable security standards for defense...
DAST
Dynamic Application Security Testing is designed to test applications in real-time under operating conditions.
Data-Centric AI
Data-centric AI systematically engineers training data quality, labeling, and consistency while holding model architecture fixed to...
Dependency
Code, libraries, or tools that your application relies on to operate. May or may not be written by a third party.
DevGovOps
DevGovOps is a framework integrating governance and compliance into the DevOps lifecycle to ensure that software delivery remains both...
DevOps
DevOps unites software development and IT operations teams.Learn More
DevOps vs DevSecOps
DevOps optimizes how you ship through Dev and Ops collaboration, while DevSecOps integrates security into every stage of the lifecycle...
DevSecOps
DevSecOps is the integration of security processes within the software development lifecycle to identify...
Docker
Docker is an open-source platform that uses containerization to package applications, ensuring software runs consistently across...
Docker Hub
Docker Hub is a cloud-based registry service that allows developers to store, share, and distribute container images to simplify...
Exposure Management
Exposure management is a continuous practice for finding and fixing exploitable risk.
Fine Tuning LLMs
Fine-tuning LLMs on narrowly focused datasets enables them to acquire deep domain expertise, significantly improving their accuracy and...
GitOps
GitOps is an operational framework that manages infrastructure configurations in Git, providing a single...
GRC
GRC is a unified strategy integrating governance, risk, and compliance into software operations to protect the organization and fulfill...
Hashing
Hashing is the process of converting input data into a fixed-length string using a mathematical algorithm to verify data integrity and...
Helm
Helm is a Kubernetes package manager that bundles application resources into versioned packages called charts to enable consistent...
How to Build Docker Images
A Docker image is a read-only template that packages an application with its dependencies and runtime configuration.
HTTP proxy
An HTTP proxy is a server that sits between web servers and clients to intercept, analyze, and forward network requests to boost...
Identity and Access Management (IAM)
Identity and access management (IAM) is a security framework for controlling user and device privileges to prevent unauthorized access...
Indirect Prompt Injection
Indirect prompt injection is a type of security vulnerability where an AI model acts maliciously as a result of malicious instructions...
Infrastructure as Code (IaC)
Infrastructure as code (IaC) is an IT management practice that provisions and manages cloud infrastructure using machine-readable...
Insider Threats
An insider threat is a security risk originating from individuals within an organization who misuse authorized access, resulting in data...
Integration Tests
A type of testing that verifies entire parts of an application work when combined with other parts of an application.
Interpreter
A tool that translates source code in a higher-level language into a lower-level language for execution, line-by-line, at runtime....
IoT
The Internet of Things (IoT) is a network of connected devices that collect and...
ISO 27001
SO 27001 is an international standard that provides a risk-based framework for establishing and...
Kubernetes Registry
A Kubernetes registry is a storage system for container images used by Kubernetes clusters to deploy application workloads reliably.
Large Language Model Operations (LLMOps)
LLMOps is a framework for managing large language model lifecycles to ensure reliable production deployment, performance, and...
License
A legal document that defines how a piece of software may be used, and what the implications are for using it. Licenses may define rules...
LLM Firewall
An LLM firewall is a layer of security between large language models (LLMs) and users that automatically analyzes and sanitizes user...
Malware Insertion
A software supply chain attack occurs when malicious actors insert malware or tampered code into the software development or delivery...
Masquerading
Masquerading is a deceptive technique where a malicious actor or artifact impersonates a trusted entity to bypass security controls and...
Microservice
A software development architecture that breaks your application up into multiple independent services that interact with one another....
Microservices Security
Microservices security is the framework of practices and controls used to safeguard distributed application services, inter-service...
ML Experiment Tracking Tool
An ML Experiment Tracking Tool is a specialized platform designed to log, organize, and analyze...
ML Model Interpretability
Machine learning model interpretability is the degree to which a human can understand how a model reaches its predictions, ensuring...
ML Pipeline
An end-to-end machine learning pipeline automates data ingestion, preprocessing, training, deployment, and monitoring to deliver...
MLOps
MLOps is a set of practices that automates the machine learning lifecycle to bridge the gap between data science and operations and...
Model Context Protocol
The Model Context Protocol (MCP) is an open, universal standard for connecting AI models to organizational data sources and tools,...
Model Deployment
Model deployment is the step within the machine learning life cycle where a new model moves into a...
Model Registry
A model registry in MLOps (Machine Learning Operations) is a centralized repository that manages the lifecycle of machine learning...
ModelOps
ModelOps is a holistic framework of practices and tools for operationalizing and governing machine learning models across an enterprise...
Monolith
A software development architecture wherein your application is built as a single unit -- front-end, back-end, and database. Until...
Multicloud Security
Multicloud security is a practice that protects data and workloads across multiple cloud environments to prevent breaches and maintain...
NIST CSF 2.0
NIST CSF 2.0 is a voluntary cybersecurity framework published by the National Institute of Standards and...
Nix
Nix is a purely functional package manager and build system that stores dependencies in isolated, hash-addressed directories to...
Operational Risk Management
Operational risk management refers to the tactical practices and systematic processes used to identify, assess, and mitigate structural...
Package Management
Packages are bundles of code used to extend the functionality of an application.
PCI DSS
PCI DSS is a global security framework mandated by the Payment Card Industry Security...
Principle of Least Privilege
The principle of least privilege is a security concept that restricts user and system access to only necessary resources to minimize...
Private Cargo Registry
A private Cargo registry serves as a centralized, controlled repository for Rust Cargo crate packages, offering enhanced security and...
Prompt Management
Prompt management versions, tests, and governs LLM prompts in production, enabling prompt updates without redeploying the application.
Q-Learning
Q-learning is a model-free reinforcement learning (RL) algorithm that enables agents to determine optimal actions by iteratively...
RBAC
Role-based access control (RBAC) is a security method that restricts system access based on user roles to...
Real-Time Machine Learning
Real-time machine learning is an infrastructure approach that processes streaming data to generate instantaneous predictions and enable...
Release Management
Release management is the structured process of planning, coordinating, and overseeing software deployments.
Remote Repository
In the context of JFrog Artifactory, a repository type that contains only remote code with an original source outside of your local...
Repository
A place to organize your source code or artifacts into one cohesive, organized group by application or project. Tools like GitHub are...
SAST
Static Application Security Testing (SAST) is an automated process that analyzes source code for flaws without running the software,...
SBOM
A Software Bill of Materials (SBOM) is a comprehensive list of all the components used to build and run an application so organizations...
SCA
Software Composition Analysis (SCA) is the automated process of identifying third-party and open source...
SDLC
The software development lifecycle (SDLC) is a structured process for building applications that ensures predictable delivery, software...
Security Misconfigurations
Security misconfiguration is a flaw in the setup or maintenance of software assets that creates unintended vulnerabilities and expands...
Self-Healing
A software supply chain that heals itself, is continuously secure, provable, and self-maintaining.
Semantic Release
Semantic release is an automated software workflow that analyzes commit history to determine version bumps and publish changelogs...
Serverless Computing
Serverless computing is a cloud execution model where cloud providers manage infrastructure scaling to allow developers to focus on core...
Service Mesh
A tool that makes it easier to monitor and control the flow of information between the microservices that make up your application. This...
Shift Left
Shift left is the practice of integrating testing and security checks earlier in software development to fix vulnerabilities faster and...
SLSA Framework
The SLSA Framework (Supply-chain Levels for Software Artifacts) is a security standard from the OpenSSF that secures the build process...
Software Artifact Repository
A software artifact repository is a centralized storage system that manages and tracks build outputs and dependencies so teams can...
Software Artifacts
A software artifact is any tangible or intangible item produced during development and deployment, including source code, binaries, and...
Software Binaries
A software binary is a machine-readable file compiled from human-readable source code that acts as the fundamental executable delivery...
Software Governance
Software governance is the framework of policies and controls managing software development, ensuring organizational alignment, security...
Software Provenance
Software provenance is the metadata that records the origin, development, and delivery of software components.
Software Vulnerability
A software vulnerability is a specific defect or weakness within an application's codebase, architecture, or configuration that exposes...
Source Control
A tool that helps manage your uncompiled source code into repositories. Examples are GitHub or Bitbucket.
SSDF
The Secure Software Development Framework (SSDF) is a set of NIST practices that embeds security into the development lifecycle to...
SSDLC
A Secure Software Development Lifecycle (SSDLC) is the integration of security controls into every stage of software engineering to...
Threat Modeling
Threat modeling is a design-time process for finding and mitigating security threats.
Typosquatting
Typosquatting is a cyber attack where malicious actors develop software packages using names that...
Ubuntu
An Ubuntu base image is a lightweight version of the Ubuntu operating system designed specifically to act as the starting building block...
Unit Tests
A type of test that aims to verify functionality within a very specific, narrow scope, e.g., a specific function or class.
Virtual Repository
In the context of JFrog Artifactory, a type of repository that acts as an envelope around the local and remote repositories that make up...
YAML
A data serialization language designed to be human-readable, frequently used for configuration files in DevOps and beyond.