SIGSHIPGlossary
Jargon, explained. In plain English.
Building with AI tools means running into words nobody explained. Here's what each one means, in one or two sentences, and where it matters.
- API key
- A secret password that lets your app use a paid service, such as OpenAI, Stripe or Resend. Whoever has it can spend your money, so it must never be in code that visitors can see. Learn more
- Environment variable (.env)
- A setting kept outside your code, often in a file called .env or in your host's dashboard. It is where secret keys belong. Learn more
- Frontend and backend
- The frontend is what runs in the visitor's browser, so anyone can see it. The backend (or server) runs on your host, out of sight. Secrets belong only in the backend.
- Server route, API route or edge function
- A small piece of backend code your website calls. It can keep secrets, check who is asking and talk to paid services safely.
- Repo (repository)
- The folder that holds your app's code, usually tracked with git and often stored on GitHub.
- Git and git history
- A tool that saves every version of your code. Old versions stay in the history, so something deleted later can still be found.
- Commit
- A saved snapshot of your code in git, with a short note about what changed.
- Pull request (PR)
- A proposed change on GitHub that can be reviewed and checked before it is added to the main code.
- CI and GitHub checks
- Automatic checks that run on every change, like tests or SIGSHIP. A failing check warns you before the change goes live.
- Terminal
- The text window where you type commands. On a Mac it is the Terminal app; on Windows it is PowerShell.
- Node.js
- The free program that runs JavaScript tools on your computer. SIGSHIP needs it, version 22 or newer, from nodejs.org.
- npx
- A command that comes with Node.js and runs a tool without installing it first. npx sigship downloads and runs SIGSHIP in one step.
- Supabase
- A popular database and login service used by many AI app builders, including Lovable and Bolt.
- Row level security (RLS)
- Supabase's lock on each table that decides who can see or change each row. Without it, anyone with your public key can read the whole table. Learn more
- Policy
- One rule inside row level security, such as "people can only read their own orders". Learn more
- Anon key and service role key
- Supabase gives you two keys. The anon key is meant to be public and is only safe with row level security on. The service role key skips every lock and must stay on the server.
- Webhook
- A message one service sends to your app when something happens, such as Stripe telling you a payment went through. Your app must check it really came from that service. Learn more
- Rate limit
- A cap on how often each person can use a feature, such as 20 times a minute. It stops scripts from running up your bill. Learn more
- CORS
- A setting that says which websites may call your server from a browser. "*" means any website. Learn more
- SQL injection
- Tricking a database into running a command by typing it into a form. It happens when apps glue user text into database commands. Learn more
- XSS (cross-site scripting)
- When someone gets their own script to run on your site in other people's browsers, usually through text your app shows as raw HTML. Learn more
- localStorage
- A small storage space in the visitor's browser. Visitors can read and change it, so it can't be trusted for things like admin access. Learn more
- Logs
- Running notes your app and host keep about what happened. Many people and tools can read them, so secrets don't belong there. Learn more
- Error boundary
- A safety net in a React app that shows a friendly message when part of the page fails, instead of a blank white screen. Learn more
- Error tracking
- A service, such as Sentry, that records errors from your live app and alerts you. Learn more
- Lockfile
- A file, such as package-lock.json, that pins every package your app uses to an exact version, so deploys don't change by surprise. Learn more
- Deploy and production
- Deploying means putting your app online. Production is the live version real people use.
- MCP (Model Context Protocol)
- A standard way to give AI coding tools extra abilities. SIGSHIP's MCP server lets Claude Code, Cursor and others run the check themselves. Learn more
- Coding agent
- An AI tool that writes and changes code for you, such as Claude Code, Cursor, or the agents inside Lovable, Bolt and Replit. Learn more
- GO and NO-GO
- SIGSHIP's verdict. NO-GO means something serious blocks launch. GO means these checks found nothing that blocks launch. It does not prove the app is safe. Learn more
- SEV-1, SEV-2 and SEV-3
- How serious a problem is. SEV-1 exposes data or money, SEV-2 makes abuse easy, and both block launch. SEV-3 is worth fixing but doesn't block. Learn more
- Exit code
- A number a command returns when it finishes. SIGSHIP returns 0 for GO and 1 for NO-GO, so scripts and AI agents can tell the result. Learn more
- False positive
- A warning about something that is actually fine. Pattern checks sometimes get it wrong, and you can report it.
- Self-hosted and Cloud
- Self-hosted runs on your own computer, like an app you install. Cloud is run for you on someone else's servers, like Gmail. Learn more
- Open source (MIT)
- The code is public for anyone to read, use and change. MIT is a short, permissive open source licence.
Check your app before your users do.
Free, open source, and nothing leaves your computer.
$ npx sigship