{
  "name": "Field Manual: security in plain English",
  "url": "https://codemarine.ai/learn/",
  "url_md": "https://codemarine.ai/learn.md",
  "terms": [
    {
      "slug": "wtf-is-a-cve",
      "term": "CVE",
      "aliases": [
        "CVE ID",
        "CVE IDs",
        "CVE Record",
        "CVE number",
        "Common Vulnerabilities and Exposures",
        "CVE Numbering Authority",
        "CNA"
      ],
      "short": "A CVE is a public ID for one specific security flaw, so everyone knows they are talking about the same bug.",
      "url": "https://codemarine.ai/learn/wtf-is-a-cve/",
      "url_md": "https://codemarine.ai/learn/wtf-is-a-cve.md",
      "section": "The basics",
      "sources": [
        {
          "name": "CVE Program: Overview",
          "url": "https://www.cve.org/About/Overview"
        },
        {
          "name": "CVE Program: CVE Record lifecycle",
          "url": "https://www.cve.org/About/Process"
        },
        {
          "name": "CVE Program: CVE Numbering Authorities",
          "url": "https://www.cve.org/ProgramOrganization/CNAs"
        },
        {
          "name": "CVE Program: Structure",
          "url": "https://www.cve.org/ProgramOrganization/Structure"
        },
        {
          "name": "CVE Program: FAQs",
          "url": "https://www.cve.org/ResourcesSupport/FAQs"
        },
        {
          "name": "NIST: National Vulnerability Database",
          "url": "https://www.nist.gov/itl/nvd"
        }
      ],
      "related": [
        "cvss-severity",
        "cisa-kev",
        "patch-and-advisory"
      ]
    },
    {
      "slug": "cisa-kev",
      "term": "CISA KEV",
      "aliases": [
        "KEV",
        "KEV catalog",
        "KEV list",
        "Known Exploited Vulnerabilities",
        "Known Exploited Vulnerabilities catalog",
        "on CISA's list",
        "CISA's list"
      ],
      "short": "The KEV catalog is the US government list of security flaws with reliable evidence of real attacks.",
      "url": "https://codemarine.ai/learn/cisa-kev/",
      "url_md": "https://codemarine.ai/learn/cisa-kev.md",
      "section": "Under attack",
      "sources": [
        {
          "name": "CISA: Known Exploited Vulnerabilities Catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "name": "CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities"
        },
        {
          "name": "CISA: BOD 26-04, Prioritizing Security Updates Based on Risk",
          "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"
        }
      ],
      "related": [
        "exploited-in-the-wild",
        "wtf-is-a-cve",
        "cvss-severity"
      ]
    },
    {
      "slug": "exploited-in-the-wild",
      "term": "Exploited in the wild",
      "aliases": [
        "in the wild",
        "actively exploited",
        "active exploitation",
        "known exploited"
      ],
      "short": "Exploited in the wild means attackers are using a flaw on real targets, not just researchers in a lab.",
      "url": "https://codemarine.ai/learn/exploited-in-the-wild/",
      "url_md": "https://codemarine.ai/learn/exploited-in-the-wild.md",
      "section": "Under attack",
      "sources": [
        {
          "name": "CISA: Reducing the Significant Risk of Known Exploited Vulnerabilities",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog/reducing-significant-risk-known-exploited-vulnerabilities"
        },
        {
          "name": "CISA: BOD 26-04, Prioritizing Security Updates Based on Risk",
          "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"
        },
        {
          "name": "FIRST: Exploit Prediction Scoring System (EPSS)",
          "url": "https://www.first.org/epss/"
        }
      ],
      "related": [
        "cisa-kev",
        "zero-day",
        "indicators-of-compromise"
      ]
    },
    {
      "slug": "zero-day",
      "term": "Zero-day",
      "aliases": [
        "zero day",
        "0-day",
        "0day",
        "zero-day attack",
        "zero-day vulnerability",
        "zero-day exploit"
      ],
      "short": "A zero-day is a flaw that gets attacked while it is still unknown, so defenders had no warning.",
      "url": "https://codemarine.ai/learn/zero-day/",
      "url_md": "https://codemarine.ai/learn/zero-day.md",
      "section": "Under attack",
      "sources": [
        {
          "name": "NIST CSRC Glossary: zero day attack",
          "url": "https://csrc.nist.gov/glossary/term/zero_day_attack"
        },
        {
          "name": "CISA: Understanding Patches and Software Updates",
          "url": "https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates"
        },
        {
          "name": "CISA: Known Exploited Vulnerabilities Catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "related": [
        "exploited-in-the-wild",
        "patch-and-advisory",
        "indicators-of-compromise"
      ]
    },
    {
      "slug": "cvss-severity",
      "term": "CVSS",
      "aliases": [
        "CVSS score",
        "CVSS rating",
        "CVSS-B",
        "severity score",
        "severity rating",
        "Common Vulnerability Scoring System"
      ],
      "short": "CVSS is a 0 to 10 score for how severe a security flaw is, not how likely it is to hit you.",
      "url": "https://codemarine.ai/learn/cvss-severity/",
      "url_md": "https://codemarine.ai/learn/cvss-severity.md",
      "section": "The basics",
      "sources": [
        {
          "name": "FIRST: Common Vulnerability Scoring System",
          "url": "https://www.first.org/cvss/"
        },
        {
          "name": "FIRST: CVSS v4.0 Specification",
          "url": "https://www.first.org/cvss/v4.0/specification-document"
        },
        {
          "name": "FIRST: CVSS v4.0 User Guide",
          "url": "https://www.first.org/cvss/v4.0/user-guide"
        },
        {
          "name": "FIRST: Exploit Prediction Scoring System (EPSS)",
          "url": "https://www.first.org/epss/"
        }
      ],
      "related": [
        "wtf-is-a-cve",
        "cisa-kev",
        "exploited-in-the-wild"
      ]
    },
    {
      "slug": "patch-and-advisory",
      "term": "Patch and advisory",
      "aliases": [
        "patch",
        "security patch",
        "advisory",
        "security advisory",
        "vendor advisory",
        "release notes",
        "upgrade to version",
        "fixed version",
        "affected versions"
      ],
      "short": "An advisory tells you what is broken and which versions are hit. A patch is the fix.",
      "url": "https://codemarine.ai/learn/patch-and-advisory/",
      "url_md": "https://codemarine.ai/learn/patch-and-advisory.md",
      "section": "The basics",
      "sources": [
        {
          "name": "CISA: Understanding Patches and Software Updates",
          "url": "https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates"
        },
        {
          "name": "CISA: Cybersecurity Alerts and Advisories",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories"
        },
        {
          "name": "NIST CSRC Glossary: patch",
          "url": "https://csrc.nist.gov/glossary/term/patch"
        },
        {
          "name": "GitHub Docs: Repository security advisories",
          "url": "https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/repository-security-advisories"
        },
        {
          "name": "GitHub Docs: GitHub Advisory Database",
          "url": "https://docs.github.com/en/code-security/concepts/vulnerability-reporting-and-management/github-advisory-database"
        }
      ],
      "related": [
        "wtf-is-a-cve",
        "zero-day",
        "indicators-of-compromise"
      ]
    },
    {
      "slug": "supply-chain-attack",
      "term": "Supply chain attack",
      "aliases": [
        "software supply chain attack",
        "supply chain compromise",
        "poisoned package",
        "malicious package",
        "compromised package",
        "malicious extension",
        "typosquatting"
      ],
      "short": "A supply chain attack reaches you through something you already trust, like a package, extension or update.",
      "url": "https://codemarine.ai/learn/supply-chain-attack/",
      "url_md": "https://codemarine.ai/learn/supply-chain-attack.md",
      "section": "AI agent threats",
      "sources": [
        {
          "name": "OWASP Top 10 2025: A03 Software Supply Chain Failures",
          "url": "https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures/"
        },
        {
          "name": "CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem",
          "url": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem"
        },
        {
          "name": "NIST CSRC Glossary: supply chain attack",
          "url": "https://csrc.nist.gov/glossary/term/supply_chain_attack"
        },
        {
          "name": "npm Docs: Threats and mitigations",
          "url": "https://docs.npmjs.com/threats-and-mitigations"
        },
        {
          "name": "VS Code Docs: Extension runtime security",
          "url": "https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security"
        }
      ],
      "related": [
        "indicators-of-compromise",
        "patch-and-advisory",
        "mcp-servers"
      ]
    },
    {
      "slug": "indicators-of-compromise",
      "term": "Indicators of compromise",
      "aliases": [
        "indicator of compromise",
        "IoC",
        "IoCs",
        "signs of compromise",
        "check for signs of compromise"
      ],
      "short": "Indicators of compromise are the tracks an attacker leaves behind, like a rogue account, file or domain.",
      "url": "https://codemarine.ai/learn/indicators-of-compromise/",
      "url_md": "https://codemarine.ai/learn/indicators-of-compromise.md",
      "section": "Under attack",
      "sources": [
        {
          "name": "NIST CSRC Glossary: indicator",
          "url": "https://csrc.nist.gov/glossary/term/indicator"
        },
        {
          "name": "CISA: #StopRansomware Guide",
          "url": "https://www.cisa.gov/stopransomware/ransomware-guide"
        },
        {
          "name": "CISA: Widespread Supply Chain Compromise Impacting npm Ecosystem",
          "url": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem"
        },
        {
          "name": "CISA: BOD 26-04, Prioritizing Security Updates Based on Risk",
          "url": "https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk"
        }
      ],
      "related": [
        "supply-chain-attack",
        "exploited-in-the-wild",
        "patch-and-advisory"
      ]
    },
    {
      "slug": "prompt-injection",
      "term": "Prompt injection",
      "aliases": [
        "direct prompt injection",
        "indirect prompt injection",
        "prompt injection attack",
        "LLM01"
      ],
      "short": "Prompt injection is when text an AI reads tricks it into following an attacker instead of you.",
      "url": "https://codemarine.ai/learn/prompt-injection/",
      "url_md": "https://codemarine.ai/learn/prompt-injection.md",
      "section": "AI agent threats",
      "sources": [
        {
          "name": "OWASP: LLM01:2025 Prompt Injection",
          "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
        },
        {
          "name": "OWASP: Prompt Injection",
          "url": "https://community.owasp.org/attacks/PromptInjection"
        },
        {
          "name": "OWASP: LLM Prompt Injection Prevention Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html"
        }
      ],
      "related": [
        "mcp-servers",
        "supply-chain-attack",
        "rce-and-privilege-escalation"
      ]
    },
    {
      "slug": "mcp-servers",
      "term": "MCP server",
      "aliases": [
        "MCP",
        "MCP servers",
        "Model Context Protocol",
        "tool poisoning",
        "rug pull"
      ],
      "short": "An MCP server plugs outside tools and data into an AI agent, and those tools can do real things.",
      "url": "https://codemarine.ai/learn/mcp-servers/",
      "url_md": "https://codemarine.ai/learn/mcp-servers.md",
      "section": "AI agent threats",
      "sources": [
        {
          "name": "MCP: What is the Model Context Protocol?",
          "url": "https://modelcontextprotocol.io/docs/getting-started/intro"
        },
        {
          "name": "MCP: Specification",
          "url": "https://modelcontextprotocol.io/specification/2026-07-28"
        },
        {
          "name": "MCP: Security Best Practices",
          "url": "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices"
        },
        {
          "name": "OWASP: MCP Security Cheat Sheet",
          "url": "https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html"
        },
        {
          "name": "OWASP: MCP Top 10 (beta)",
          "url": "https://owasp.org/projects/mcp-top-10"
        }
      ],
      "related": [
        "prompt-injection",
        "supply-chain-attack",
        "rce-and-privilege-escalation"
      ]
    },
    {
      "slug": "rce-and-privilege-escalation",
      "term": "RCE and privilege escalation",
      "aliases": [
        "RCE",
        "remote code execution",
        "privilege escalation",
        "privesc",
        "root access",
        "root privileges",
        "full takeover",
        "chained flaws",
        "exploit chain",
        "vulnerability chain"
      ],
      "short": "RCE lets an attacker run their code on your system. Privilege escalation gets them more power once inside.",
      "url": "https://codemarine.ai/learn/rce-and-privilege-escalation/",
      "url_md": "https://codemarine.ai/learn/rce-and-privilege-escalation.md",
      "section": "Under attack",
      "sources": [
        {
          "name": "MITRE ATT&CK: Privilege Escalation (TA0004)",
          "url": "https://attack.mitre.org/tactics/TA0004/"
        },
        {
          "name": "MITRE CWE-94: Improper Control of Generation of Code",
          "url": "https://cwe.mitre.org/data/definitions/94.html"
        },
        {
          "name": "MITRE CWE-78: OS Command Injection",
          "url": "https://cwe.mitre.org/data/definitions/78.html"
        },
        {
          "name": "OWASP: Code Injection",
          "url": "https://community.owasp.org/attacks/Code_Injection"
        },
        {
          "name": "FIRST: CVSS v4.0 Specification",
          "url": "https://www.first.org/cvss/v4.0/specification-document"
        }
      ],
      "related": [
        "cvss-severity",
        "exploited-in-the-wild",
        "prompt-injection"
      ]
    }
  ]
}