MAGDOX Code Security documentation
Glossary
Terms used across the product and these pages.
Status: Preview
| Term | Meaning |
|---|---|
| Organisation | The tenant. Owns projects, runs, members and tokens. |
| Project | A repository or supported codebase registered in an organisation. |
| Run | One scan of one project at one point in time. |
| Findings payload | The versioned JSON a scan uploads. Findings metadata and components; never source files. |
| Fingerprint | Hash of rule, path and normalised code used to track a finding across runs without storing code. |
| Rule bundle | Signed, versioned package of rules and vulnerability data the CLI verifies and caches. |
| Snippet policy | Organisation setting (off, redacted, full) controlling whether code appears in payloads. |
| Dashboard | Where runs from every repository are tracked, triaged and reported. |
| Baseline | An earlier run used to classify findings as new, fixed or unchanged. |
| Disposition | A reviewer's recorded decision on a finding, with reason. |
| Coverage | What was analysed, skipped, unsupported or failed in a run. |
| Gate | A rule that turns run results into a pass or fail for a pipeline. |
| SAST | Static application security testing of first-party source code. |
| SCA | Software composition analysis of dependencies. |
| SBOM | Software bill of materials (CycloneDX or SPDX). |
| CBOM | Cryptographic bill of materials (CycloneDX CBOM). |
| SARIF | Static Analysis Results Interchange Format for findings. |