| Weighted Routing |
A DNS routing policy (in Amazon Route 53 and similar authoritative DNS services) that distributes incoming query responses across multiple endpoints according to assigned numeric weights; widely used for canary releases and gradual blue-green infrastructure migrations |
| Observability |
The engineering capability to understand a distributed system's internal health and diagnose latency or error bottlenecks purely from its external telemetry outputs—built on the three pillars of metrics, structured JSON logs, and distributed traces |
| Authoritative Nameserver |
The final source-of-truth DNS nameserver (such as Amazon Route 53 or Cloudflare DNS) that stores and serves the official DNS resource records for a specific domain zone |
| Default Deny |
The foundational security principle under which every access request is denied by default unless explicitly permitted by an authorization rule (such as a PostgreSQL RLS policy, security group rule, or mesh VPN ACL) |
| Device Posture |
A Zero Trust security control that continuously verifies an endpoint device's security health—including operating system version and patch level, full-disk encryption, corporate MDM enrollment, and active EDR agent status—before permitting network or application access |
| Dead Letter Queue (DLQ) |
A dedicated holding queue in asynchronous message brokers (such as Cloudflare Queues) that isolates messages that have exhausted all configured retry attempts so failed jobs are never lost and can be inspected, debugged, and replayed safely |
| Configuration Drift |
The state in which live cloud infrastructure diverges from the desired state declared in Terraform code (.tf), typically caused by manual out-of-band hotfixes or console edits (ClickOps) |
| Rate Limiting |
A defensive traffic control that caps the maximum number of requests a given IP address, user session, or API token can send within a defined time window in order to stop brute-force credential attacks, scraping, and runaway AI token bills |
| Zone Apex (Root Domain) |
The root level of a DNS zone without any subdomain prefix (for example, example.com). Because the Zone Apex must always contain SOA and NS records, DNS standards forbid placing a standard CNAME record there |
| Log Scrubbing (Redaction) |
Automatically stripping or replacing sensitive fields—such as passwords, API keys, session cookies, Authorization headers, and personal data—with [REDACTED] before logs or distributed trace spans are stored or exported to external collectors |
| Region |
A geographic cluster of cloud data centers (for example, AWS Seoul ap-northeast-2 or Vercel icn1). Placing serverless functions in the same region as the primary database minimizes sequential query round-trip latency |
| Mesh VPN |
A virtual private network in which a central control plane coordinates public keys and access policies while authorized nodes establish encrypted point-to-point WireGuard tunnels directly (peer-to-peer) without tromboning traffic through a central gateway |
| Terraform Module |
A reusable, self-contained directory structure that packages related Terraform resources behind clearly defined input variables (variable blocks) and output values (output blocks) |
Protection Bypass Secret (x-vercel-protection-bypass) |
A dedicated HTTP request header secret that allows automated CI end-to-end (E2E) test suites and webhook senders to pass through Vercel Deployment Protection on Preview URLs without human sign-in |
| Backhauling |
An inefficient legacy routing pattern in which remote employees' cloud and internet traffic is forced to travel through a physical corporate headquarters VPN concentrator before going back out to cloud services |
| Recovery Time Objective (RTO) |
The maximum acceptable elapsed time between the onset of a service outage or disaster and the full restoration of normal production operation |
| Recovery Point Objective (RPO) |
The maximum acceptable age of lost data measured backward in time from an incident (for example, a 1-minute RPO requires recovering all database writes committed up to within 60 seconds before the failure) |
| Split-Horizon DNS (Split-Brain DNS) |
Serving different DNS answers to internal ZTNA/VPN queries versus external public queries—or resolving internal-only domain names exclusively on private resolvers—so internal server hostnames and private IPs never leak into public DNS |
| Split Tunneling |
Routing only traffic destined for internal corporate CIDR blocks or internal domains (Include mode) into the VPN or ZTNA tunnel while allowing general public internet traffic to egress directly via the user's local ISP connection |
| Blameless Postmortem |
A post-incident engineering review and document that avoids punishing individuals and instead identifies the systemic, testing, and architectural gaps that allowed a human error to cause an outage, producing concrete preventive action items |
| Subnet Router |
A bridge node deployed inside a private VPC subnet that relays mesh VPN traffic to internal resources (such as managed AWS RDS databases or legacy appliances) where a VPN agent binary cannot be installed directly |
| Serverless Function |
An event-driven compute unit that spins up on demand to handle incoming requests without requiring persistent virtual machines; paired with transaction-mode connection poolers to prevent database connection exhaustion |
| Signed URL |
A temporary URL bearing a cryptographic signature and a short expiration timestamp that authorizes uploading or downloading a specific object inside a Private storage bucket without making the bucket public |
service_role key |
The superuser-equivalent backend secret key in Supabase that bypasses all Row Level Security policies (BYPASSRLS). Exposing it in client bundles or untrusted routes compromises the entire database |
| Circuit Breaker |
A resilience pattern that immediately blocks outbound calls to a failing downstream service (trips Open) and returns a fast fallback once consecutive errors cross a threshold, preventing cascading failures and retry storms |
| Declarative IaC |
Defining what the desired target infrastructure state should look like in code so the provisioning tool calculates and applies the exact delta (diff) against live state, rather than scripting step-by-step procedural commands (how) |
| Session Mode (port 5432) |
The Supavisor connection pooling mode that dedicates a backend PostgreSQL connection 1:1 to a single client until the client disconnects; used for schema migrations and workloads requiring session-level locks or prepared statements |
| State Locking |
Acquiring an atomic mutual-exclusion lock (via native S3 .tflock conditional writes or DynamoDB) during terraform plan and apply so concurrent runs cannot overwrite and corrupt terraform.tfstate |
State File (terraform.tfstate) |
The core JSON ledger that maps logical resource addresses in .tf code to real physical cloud resource IDs and attributes. Because it contains plaintext secrets, it must never be committed to Git and must reside in an encrypted remote backend |
| Point-in-Time Recovery (PITR) |
Combining periodic physical base backups with continuous archiving of PostgreSQL's Write-Ahead Log (WAL) so a database can be replayed and restored to any exact second prior to an accidental deletion or corruption |
| Outbound-only Tunnel |
A Zero Trust connectivity pattern in which an internal connector daemon (such as cloudflared) initiates an outbound encrypted connection to the edge first, enabling authorized users to reach internal services with zero open inbound firewall ports |
anon key |
The public client-side key in Supabase intended to be embedded in browser and mobile apps; carries no bypass privileges of its own and relies completely on PostgreSQL Row Level Security (RLS) policies to enforce access control |
| Origin Lockdown |
Preventing attackers from bypassing Cloudflare and its WAF via direct-to-IP requests by locking the origin server behind Cloudflare IP firewall allowlists, Authenticated Origin Pulls (mTLS), or Cloudflare Tunnel |
| Dual-Key Rotation |
Rotating signing secrets or webhook keys with zero downtime by signing new tokens exclusively with the newest key while accepting both the newest key and the immediately preceding key during a verification grace window |
| Recursive Resolver |
A DNS server (such as 1.1.1.1, 8.8.8.8, or an ISP resolver) that accepts queries from client devices, traverses the root, TLD, and authoritative nameservers to find the answer, and caches the result for the duration of the record's TTL |
| Zero Trust Architecture (NIST SP 800-207) |
A security model that grants zero implicit trust based on physical or network location (such as having an internal LAN IP) and instead continuously verifies identity, device posture, and context on every per-resource request with least privilege |
| Exponential Backoff with Jitter |
Doubling retry wait intervals exponentially (1 s, 2 s, 4 s, 8 s...) while adding a randomized time offset (jitter) so hundreds of clients do not synchronize their retries and knock over a recovering downstream dependency |
| Cache Poisoning (Web Cache Deception) |
A severe security vulnerability in which personalized API responses or Set-Cookie session headers are stored inside a shared CDN edge cache and served to subsequent visitors, leaking private account data and active sessions |
Tail Latency (p95 / p99) |
The response latency experienced by the slowest 5% (95th percentile) or slowest 1% (99th percentile) of requests when all requests are sorted by duration; essential for measuring real user experience on AI and database routes |
| Transaction Mode (port 6543) |
The Supavisor connection pooling mode that leases a backend PostgreSQL connection only for the duration of a single transaction (BEGIN to COMMIT) and returns it immediately to the pool; the mandatory standard for serverless function runtimes |
Replace (-/+, Destroy and Recreate) |
The Terraform plan action triggered when an immutable resource attribute is modified, completely deleting (-) the existing cloud resource and creating (+) a brand-new replacement—causing catastrophic data loss on stateful resources |
| Row Level Security (RLS) |
The native PostgreSQL security mechanism that enforces fine-grained, per-row access control directly inside the database engine using USING expressions (to filter existing rows) and WITH CHECK expressions (to validate new or updated rows) |
| Lateral Movement |
An post-compromise attack technique in which an intruder who compromises a single endpoint or server pivots sideways across an open internal network subnet to scan and compromise neighboring servers and databases |
| AI Gateway |
A specialized edge proxy sitting between an application backend and external LLM providers that delivers unified logging and cost analytics, deterministic prompt caching, rate limiting, and automated multi-provider fallbacks |
Alias Record |
An Amazon Route 53 record extension that maps a root domain (Zone Apex) or subdomain to dynamic-IP cloud targets (such as AWS ALBs or CloudFront distributions) while returning standard A or AAAA IP answers to querying resolvers |
| CAA (Certification Authority Authorization) |
A DNS resource record specifying which Certificate Authorities (CAs) are authorized to issue TLS certificates for a domain, preventing unauthorized CAs from mis-issuing certificates |
| DERP (Designated Encrypted Relay for Packets) |
An encrypted relay server operating over standard HTTPS (TCP port 443) used by WireGuard mesh VPNs to forward end-to-end encrypted packets whenever strict firewalls or NAT gateways block direct peer-to-peer UDP hole punching |
| Expand-Contract (Parallel Change) |
Phasing database schema changes into four steps—Expand (add nullable column) → Dual-Write & Backfill → Cutover → Contract (drop old column)—to preserve backward compatibility and instant rollback safety during rolling deployments |
| Fluid Compute |
Vercel's serverless execution model that allows a single warm function instance to handle multiple concurrent requests while waiting on slow external network I/O (such as LLM token streaming), slashing cold starts and idle compute billing |
Full (Strict) |
The production-standard Cloudflare SSL/TLS encryption mode that encrypts both the Browser-to-Cloudflare leg and the Cloudflare-to-Origin leg over HTTPS while strictly verifying the origin server's TLS certificate against a trusted CA or Origin CA |
moved Block |
A declarative HCL block in Terraform that updates a resource's logical address or module path inside terraform.tfstate during code refactoring without destroying or recreating the underlying cloud resource |
NEXT_PUBLIC_ |
The Next.js environment variable prefix that instructs the bundler to inline the variable's literal string value directly into client JavaScript bundles at build time; must never be attached to secret keys |
NODE_EXTRA_CA_CERTS |
The Node.js environment variable that appends a custom enterprise ZTNA Root CA certificate file (.pem) onto Node's built-in public CA trust list so Node runtimes and AI coding agents pass TLS inspection verification |
OIDC (AssumeRoleWithWebIdentity) |
The keyless authentication standard in which CI/CD pipelines (such as GitHub Actions) exchange a short-lived, cryptographically signed identity JWT for temporary cloud IAM credentials without storing static long-lived secret keys |
prevent_destroy |
A Terraform lifecycle meta-argument setting that causes terraform plan to abort immediately with a hard error whenever a proposed change would delete (-) or replace (-/+) a protected stateful resource |
| RFC 1918 |
The internet standard reserving private IPv4 address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16); corporate VPC and VPN designs must avoid colliding with common consumer Wi-Fi router defaults in 192.168.x.x |
| SCIM (System for Cross-domain Identity Management) |
An open standard protocol that automatically synchronizes user onboarding, group membership changes, and offboarding from a central IdP (Okta, Entra ID) to ZTNA and SaaS tools, revoking departing users' access and active sessions immediately |
| TTL (Time To Live) |
The duration in seconds for which a DNS record or cached HTTP response may be served from a recursive resolver or CDN edge cache without re-querying the authoritative source; must be lowered well in advance before a zero-downtime DNS migration |
USING / WITH CHECK |
The two policy clauses in PostgreSQL Row Level Security: USING filters which existing table rows can be read, updated, or deleted, whereas WITH CHECK validates the proposed state of newly inserted or updated rows |