| Asset |
A host, application inventory, or external target belonging to an organisation |
| Inventory |
Packages and host facts reported at a point in time |
| Advisory |
Published information used to evaluate an affected product or version |
| Finding |
A recorded affected state for an asset |
| Coverage |
What the scan could and could not assess |
| Confidence |
Strength of evidence for a detection conclusion |
| Priority |
Operational order for addressing a finding |
| SBOM |
Software bill of materials supplied by an application build |
| purl |
Package URL used to identify an ecosystem, package, and version |
| Canary |
A host changed before a broader rollout |
| Soak period |
Time a canary must remain healthy before broad rollout |
| Ledger |
Hash-linked record of events |
| Checkpoint |
Signed ledger state preserved outside the database |
| Evidence pack |
Exported data, ledger material, and signature for offline verification |
| Fingerprint |
SHA-256 identifier used to check a trusted signing key |
| Enrolment token |
Credential used to register hosts and obtain asset credentials |
| Upload token |
Credential scoped to one asset's SBOM uploads |
| Organisation API token |
Read-only credential for permitted API reads |