AI and vibe coding glossary

AI systems that take actions in the world over multiple steps, not just produce a single response.

Software development where an AI agent autonomously plans, writes, tests and ships code with minimal human keystrokes.

A software system that uses an AI model to perceive its environment, make decisions and take actions to achieve a goal over multiple steps.

The practical knowledge and judgement needed to use AI tools effectively and safely in a workplace context.

A structured assessment of how prepared an organisation is to adopt, govern and get value from AI tools and systems.

An industry term for making web content easy for search and AI answer systems to find, understand and cite.

The maximum amount of text (measured in tokens) a language model can process in a single request, covering both input and output.

Numerical vector representations of text (or other content) that capture semantic meaning, enabling similarity search and retrieval.

Adjusting a pre-trained AI model's weights on a smaller, specialised dataset so it performs better on a specific task.

A large AI model pre-trained on broad data that developers can adapt to many downstream tasks.

A part time or contract executive who provides AI strategy, governance and implementation leadership without the cost of a full time hire.

The emerging practice of improving how generative search systems can understand, retrieve and represent published content.

Controls applied around or inside an AI system to constrain its outputs and prevent harmful, incorrect or out of scope responses.

When an AI model generates output that is plausible but factually incorrect or fabricated.

An adversarial prompt that bypasses an AI model's built in safety rules to make it produce content it normally would not.

A neural network trained on large volumes of text that can generate, summarise, translate and reason about language.

An open standard from Anthropic that lets AI assistants connect to external tools and data sources securely.

The practice of writing inputs to AI models in ways that produce reliable, well structured outputs.

An AI architecture that retrieves relevant documents from a knowledge base and feeds them to a model so the model answers from your data.

Developer supplied instructions that set an AI model's role, rules and behaviour at a higher priority than ordinary user input.

The unit of text that language models process, roughly corresponding to a word or a few characters.

A specialised database that stores text or other content as numeric embeddings and supports similarity search.

Building software primarily by prompting an AI in plain English rather than writing the code yourself.

A secret credential string used to authenticate a calling application to an API, granting it access to that service's resources.

A browser security mechanism that controls which origins may make requests to an API or resource from client side JavaScript.

An attack that abuses a user's authenticated session to perform actions they did not intend, by tricking their browser into making a request.

An attack that injects malicious script into a trusted website so it runs in other users' browsers.

Technology and policy controls that detect and prevent sensitive data from being sent to unauthorised destinations, including AI tools.

Declarative access control rules for Firebase Firestore, Realtime Database and Cloud Storage that the server evaluates for every read or write.

A login security control requiring two or more verification factors so a stolen password alone is not sufficient to compromise an account.

A list of the most critical web application security risks, maintained by the Open Web Application Security Project.

OWASP's parallel security list specifically for applications built on large language models.

An authorised simulated attack on a system to find vulnerabilities before a real attacker does.

An attack where untrusted input contains instructions that the AI model follows, overriding the developer's intent.

Controls on how many requests a client can make to an API or endpoint within a time window, preventing abuse and denial of service.

A model that grants permissions to roles, then assigns users to those roles, rather than assigning permissions to each user individually.

The accidental exposure of a credential, API key, private key or password in source code, a git repository or a public facing file.

An attack where a server is tricked into making an HTTP request to an internal or unexpected destination on behalf of an attacker.

The use of AI tools by staff without IT or management knowledge or approval, often involving personal data sent to consumer AI products.

Postgres feature, exposed in Supabase, that enforces per row access rules so the database itself decides who can see or modify each row.

A security attack that targets a dependency, vendor or component in the software supply chain rather than the target application directly.

A security model that trusts no user, device or service by default, including those inside the network perimeter.

An HTTP response header that tells browsers which sources of script, style, image and other content the page may load.

A named value injected into an application at runtime, used to configure behaviour and inject secrets without committing them to code.

A file that maps minified production JavaScript back to the original source code, useful for debugging but a leak risk if shipped to production.