Why These Terms Matter

Software engineering has its own dense vocabulary, and it changes faster than most technical fields — a term that meant one thing in the era of monolithic desktop applications now describes something entirely different in a cloud-native, containerized world. For engineers from other disciplines moving into full-stack development, DevOps, or cloud architecture, this vocabulary gap is often the biggest barrier to reading documentation, following a system design discussion, or passing a technical interview.

Unlike a code standard such as the NEC, most software terms are not defined in a single authoritative document — they emerge from industry practice, RFCs (Request for Comments documents that define internet protocols), and de facto convention among practitioners. This glossary covers 55 of the most important and most frequently encountered terms across application development, cloud infrastructure, and DevOps practice, organized alphabetically with plain-language explanations and, where applicable, references to the standards or specifications that formalize them.

A

API (Application Programming Interface) — software contract
A defined set of rules and endpoints that allows one piece of software to request services or data from another. A weather app calling a weather service's API to retrieve a forecast is a simple example. APIs are the connective tissue of modern software — nearly every application is built by combining calls to internal and third-party APIs rather than writing every function from scratch.
Authentication vs. Authorization — access control concepts
Authentication verifies who a user is (logging in with a password, a passkey, or a token). Authorization determines what an authenticated user is allowed to do (whether they can view, edit, or delete a specific resource). The two are frequently confused but solve different problems — a system can authenticate a user correctly and still deny them authorization to a specific action.
Auto-scaling — cloud infrastructure
The automatic addition or removal of compute resources (servers, containers) in response to real-time demand, so that an application has enough capacity during traffic spikes without paying for idle capacity during quiet periods. Cloud providers implement auto-scaling using metrics like CPU utilization, request queue depth, or custom application metrics as triggers.

B

Backend — application architecture
The server-side portion of an application that handles business logic, database access, authentication, and API responses — everything the user does not directly see. It is contrasted with the frontend, which is the user interface running in the browser or on a device.
Branch (version control) — Git terminology
An independent line of development within a version-controlled codebase, allowing a developer to make changes without affecting the main codebase until those changes are reviewed and merged. Feature branches, release branches, and hotfix branches are common conventions for organizing parallel work.

C

Cache — performance optimization
A temporary storage layer that keeps a copy of frequently accessed data close to where it is needed, so future requests for that data can be served faster than re-fetching or re-computing it. Caches exist at many layers: browser caches, CDN edge caches, in-memory application caches (Redis, Memcached), and database query caches. Cache invalidation — knowing when cached data is stale and must be refreshed — is famously one of the hardest problems in computer science.
CDN (Content Delivery Network) — infrastructure
A geographically distributed network of servers that cache and serve static content (images, videos, JavaScript, CSS) from a location physically close to the requesting user, reducing latency. Cloudflare, Akamai, and Amazon CloudFront are common CDN providers.
CI/CD (Continuous Integration / Continuous Delivery or Deployment) — DevOps practice
Continuous Integration is the practice of automatically building and testing code every time a developer merges changes, catching integration problems early. Continuous Delivery extends this by automatically preparing every passing build for release; Continuous Deployment goes one step further and automatically pushes every passing build to production without manual approval. CI/CD pipelines (built with tools like GitHub Actions, GitLab CI, or Jenkins) are the backbone of modern software delivery.
Container — virtualization technology
A lightweight, standalone package of software that includes everything needed to run an application — code, runtime, system libraries, and settings — isolated from the host machine and other containers, but sharing the host's operating system kernel (unlike a full virtual machine, which includes its own OS). Docker is the dominant containerization platform.
CORS (Cross-Origin Resource Sharing) — browser security
A browser security mechanism that restricts web pages from making requests to a domain other than the one that served the page, unless the target server explicitly permits it via HTTP response headers. CORS errors are one of the most common frustrations for developers building applications where the frontend and backend are hosted on different domains.

D

Database Index — database performance
A data structure (commonly a B-tree) that a database maintains alongside a table to allow fast lookups of rows matching a given column value, without scanning every row in the table. Indexes dramatically speed up read queries but add overhead to write operations and consume additional storage, so they are applied selectively to columns that are frequently searched or joined on.
Dependency — software packaging
An external library or package that a piece of software relies on to function. Dependency management tools (npm for JavaScript, pip for Python, Maven for Java) track which versions of which packages a project needs, and a lock file (such as package-lock.json) pins exact versions so that builds are reproducible across machines.
DNS (Domain Name System) — internet infrastructure
The distributed system that translates human-readable domain names (like example.com) into the numeric IP addresses that computers use to route network traffic. DNS resolution is one of the first steps in nearly every network request and a common source of latency and outages when misconfigured.
Docker — containerization platform
The most widely used platform for building, distributing, and running containers. A Dockerfile defines the steps to build a container image (install dependencies, copy code, set the startup command), and that image can then be run identically on a developer's laptop, a CI server, or a production cloud environment — solving the classic "it works on my machine" problem.

E

Endpoint — API terminology
A specific URL that an API exposes for a client to send requests to, typically associated with an HTTP method (GET, POST, PUT, DELETE) and a resource — for example, GET /users/123 to retrieve user 123's data.
Environment Variable — configuration management
A named value stored outside of an application's source code (typically in the operating system or a deployment platform's configuration) and read by the application at runtime. Environment variables are the standard way to inject configuration that differs between environments — database URLs, API keys, feature flags — without hardcoding secrets into source code that gets committed to version control.

F

Frontend — application architecture
The client-side portion of an application that runs in the user's browser or on their device and renders the user interface, handles user interaction, and communicates with backend APIs. Modern frontends are commonly built with frameworks like React, Vue, or Angular.
Full Stack — engineering role/skillset
Describes an engineer or an application that spans both frontend and backend development — from the database schema through the API layer to the rendered user interface — rather than specializing in only one layer.

G

Git — distributed version control system
The dominant system for tracking changes to source code over time, allowing multiple developers to work on the same codebase concurrently, review each other's changes, and revert to previous states when necessary. GitHub, GitLab, and Bitbucket are hosted platforms built around Git.
GraphQL — API query language
A query language and runtime for APIs, developed by Facebook, that lets a client specify exactly which fields of data it needs in a single request — rather than the fixed response shapes of a traditional REST endpoint. This avoids both over-fetching (receiving unused data) and under-fetching (needing multiple round-trip requests) that are common with REST.

H

HTTP Status Code — protocol response codes
A three-digit code returned by a server indicating the result of an HTTP request. The ranges carry meaning: 2xx indicates success (200 OK, 201 Created), 3xx indicates redirection, 4xx indicates a client error (404 Not Found, 401 Unauthorized, 403 Forbidden), and 5xx indicates a server error (500 Internal Server Error, 503 Service Unavailable).
Horizontal vs. Vertical Scaling — infrastructure strategy
Vertical scaling increases the capacity of a single machine (more CPU, more RAM). Horizontal scaling adds more machines running the same application in parallel, typically behind a load balancer. Horizontal scaling is generally preferred for cloud-native applications because it has no hard ceiling and improves fault tolerance — losing one of many machines is less catastrophic than losing the only machine.

I

Idempotency — API design principle
An operation is idempotent if performing it multiple times produces the same result as performing it once. Setting a user's email address to a specific value is idempotent (repeating it changes nothing further); incrementing a counter is not (each repetition adds one more). Idempotency matters for building reliable systems that must safely retry failed network requests without causing duplicate side effects, such as double-charging a customer.
Infrastructure as Code (IaC) — DevOps practice
The practice of defining and provisioning cloud infrastructure (servers, networks, databases) through machine-readable configuration files rather than manual, click-through setup in a cloud console. Terraform, AWS CloudFormation, and Pulumi are common IaC tools. IaC makes infrastructure changes reviewable, version-controlled, and repeatable across environments.

J

JWT (JSON Web Token) — authentication mechanism
A compact, digitally signed token format (defined by RFC 7519) commonly used to represent a logged-in user's identity and permissions. A JWT is self-contained — a server can verify the token's signature and read the claims inside it without a database lookup — which makes it popular for stateless authentication across distributed services, though it introduces its own tradeoffs around token revocation.

K

Kubernetes (K8s) — container orchestration
An open-source platform, originally developed at Google, for automating the deployment, scaling, networking, and healing of containerized applications across a cluster of machines. Kubernetes handles tasks like restarting a crashed container, distributing traffic across replicas, and rolling out new versions with zero downtime — problems that become unmanageable to handle manually once an application runs more than a handful of containers.

L

Latency — performance metric
The time delay between a request being sent and a response being received, typically measured in milliseconds. Latency is distinct from throughput (the volume of requests a system can handle per unit time) — a system can have low latency but low throughput, or vice versa, and both matter for a responsive user experience under real-world load.
Load Balancer — infrastructure component
A component that distributes incoming network traffic across multiple backend servers so that no single server becomes overwhelmed, and that can detect and route around unhealthy servers. Load balancers are essential for horizontal scaling and high availability.
Logging vs. Monitoring vs. Observability — operational visibility
Logging records discrete events (an error, a request, a state change) as text or structured records. Monitoring tracks aggregate metrics over time (CPU usage, request rate, error rate) and alerts when thresholds are crossed. Observability is the broader property of a system being understandable from its external outputs — combining logs, metrics, and traces so engineers can diagnose problems they did not anticipate in advance, not just ones they built specific dashboards for.

M

Message Queue — asynchronous processing
A system (such as RabbitMQ, Amazon SQS, or Kafka) that lets one part of an application send messages to be processed by another part asynchronously, decoupling the sender from the receiver's processing speed. Queues allow a system to absorb traffic spikes, retry failed work, and process tasks (like sending emails or resizing images) in the background without blocking the user-facing request.
Microservices — architecture pattern
An architectural style in which an application is built as a collection of small, independently deployable services, each responsible for a specific business capability and communicating over a network (typically via APIs or message queues), as opposed to a monolith where all functionality lives in a single deployable codebase. Microservices improve team autonomy and independent scalability at the cost of significantly increased operational complexity.
Migration (database) — schema management
A version-controlled script that makes an incremental change to a database's schema (adding a column, creating a table, changing a data type) in a repeatable, trackable way, so the same sequence of changes can be applied consistently across development, staging, and production databases.
Monolith — architecture pattern
An application built and deployed as a single, unified codebase and process, where all functionality — user interface, business logic, data access — is tightly coupled together. Monoliths are simpler to develop and deploy at small scale but become harder to maintain and scale independently as the application and team grow, which is the usual motivation for migrating toward microservices.

N

N+1 Query Problem — database performance anti-pattern
A common performance bug where code fetches a list of N records with one query, then executes one additional query per record to fetch related data — resulting in N+1 total queries instead of a single, efficient join or batch query. This anti-pattern is a frequent cause of slow API responses as data volume grows.
NoSQL — database category
A broad category of databases that do not use the traditional relational (table-and-row, SQL-query) model — including document stores (MongoDB), key-value stores (Redis, DynamoDB), and graph databases (Neo4j). NoSQL databases typically trade some of the strict consistency guarantees of relational databases for flexibility in data structure and easier horizontal scaling.

O

OAuth — authorization protocol
An open standard authorization protocol that lets a user grant a third-party application limited access to their data on another service, without sharing their password — the mechanism behind "Sign in with Google" or "Connect your calendar" flows. OAuth is an authorization framework, not an authentication protocol on its own; OpenID Connect builds authentication on top of it.
ORM (Object-Relational Mapping) — data access pattern
A library (such as Prisma, SQLAlchemy, or Hibernate) that lets developers interact with a relational database using the object-oriented constructs of their programming language rather than writing raw SQL for every query. ORMs speed up development and reduce SQL injection risk, at the cost of some performance and the potential to obscure inefficient queries (see N+1 Query Problem).

P

Pull Request (PR) / Merge Request (MR) — code review workflow
A request to merge a set of code changes from one branch into another, opened for team review and discussion before the merge happens. PRs are the standard mechanism for code review, automated CI checks, and maintaining a record of why a change was made.

Q

Query Optimization — database performance
The process of restructuring a database query, or adding supporting indexes, so that the database engine can retrieve the requested data with less computational work. Most relational databases provide an EXPLAIN (or EXPLAIN ANALYZE) command that shows the execution plan a query will use, which is the primary diagnostic tool for query optimization.

R

Race Condition — concurrency bug
A bug that occurs when the behavior of a system depends on the relative timing of two or more concurrent operations, and that timing is not properly controlled — for example, two requests simultaneously reading and updating the same bank balance, each unaware of the other's change, resulting in a lost update. Race conditions are notoriously difficult to reproduce and debug because they depend on timing that varies between runs.
Rate Limiting — API protection mechanism
A control that restricts how many requests a client can make to an API within a given time window, protecting the service from abuse, accidental traffic floods, and resource exhaustion. Rate limits are commonly communicated to clients via HTTP headers and enforced with the 429 Too Many Requests status code.
REST (Representational State Transfer) — API architectural style
An architectural style for designing networked APIs around resources (nouns, like "users" or "orders") that are manipulated using standard HTTP methods (GET to read, POST to create, PUT/PATCH to update, DELETE to remove). REST is not a formal protocol or standard but a set of conventions, and "RESTful" APIs vary in how strictly they follow them.
Row-Level Security (RLS) — database access control
A database feature (supported natively in PostgreSQL and exposed prominently by platforms like Supabase) that restricts which rows a given database user or role can see or modify, enforced directly by the database engine rather than solely by application code. This provides a strong, defense-in-depth layer of authorization that still applies even if application-layer checks are bypassed or contain a bug.

S

Serverless — cloud execution model
A cloud computing model in which the provider automatically manages the provisioning and scaling of servers, and the developer deploys individual functions or services that run only in response to events, without managing any underlying server instances directly. AWS Lambda, Vercel Functions, and Cloudflare Workers are common serverless platforms. Billing is typically based on actual execution time rather than reserved capacity.
SLA (Service Level Agreement) — reliability commitment
A formal commitment from a service provider specifying a guaranteed level of performance or availability — commonly expressed as "uptime percentage" (for example, 99.9% uptime, sometimes called "three nines"), along with the remedies if that commitment is not met. Related informal terms are SLO (Service Level Objective, an internal target) and SLI (Service Level Indicator, the actual measured metric).
SQL Injection — security vulnerability
A security vulnerability where an attacker inserts malicious SQL code into an application's input fields, which is then executed by the database because the application concatenated untrusted input directly into a query string instead of using parameterized queries. SQL injection remains one of the most common and most damaging web application vulnerabilities, and is entirely preventable through parameterized queries or an ORM.
SSR / SSG / CSR — frontend rendering strategies
Server-Side Rendering (SSR) generates a page's HTML on the server for each request. Static Site Generation (SSG) generates HTML once at build time and serves the same static file to every visitor. Client-Side Rendering (CSR) ships a mostly empty HTML page and builds the content in the browser using JavaScript. Modern frameworks like Next.js let a single application mix all three strategies on a per-page basis depending on how dynamic and SEO-sensitive that page's content is.

T

Technical Debt — engineering management concept
The implied future cost of choosing an easy or quick solution now instead of a more thorough, better-engineered approach — analogous to financial debt, technical debt accrues "interest" in the form of increased difficulty and risk when the codebase is later changed. Some technical debt is a reasonable, deliberate tradeoff to ship faster; unmanaged debt compounds and eventually slows a team to a crawl.
Throughput — performance metric
The number of requests, transactions, or units of work a system can process in a given period of time (often expressed as requests per second). See also Latency, which measures the delay of an individual request rather than the aggregate volume the system can handle.

U

Unit Test / Integration Test / End-to-End Test — testing pyramid
A unit test verifies a single function or component in isolation. An integration test verifies that multiple components work correctly together (for example, an API endpoint and the database it queries). An end-to-end (E2E) test simulates a real user's full workflow through the entire deployed application. The "testing pyramid" convention favors having many fast unit tests, fewer integration tests, and a small number of slower end-to-end tests.

V

Version Control — source code management
A system for tracking and managing changes to source code over time, enabling collaboration, history, and the ability to revert changes. Git is the dominant version control system in modern software development, though older systems like Subversion (SVN) are still found in legacy environments.
Vertical vs. Horizontal Scaling — see Horizontal vs. Vertical Scaling above.
Cross-reference: this pairing is more commonly searched under "horizontal vs vertical scaling" — see the entry under H.

W

Webhook — event notification mechanism
An automated HTTP callback: instead of one system repeatedly polling another to check for new data, the source system sends an HTTP POST request to a URL the receiving system has registered, the moment an event occurs. Payment providers (like Stripe) use webhooks to notify an application the instant a payment succeeds or fails.
WebSocket — real-time communication protocol
A communication protocol that provides a persistent, full-duplex connection between a client and server over a single TCP connection, allowing either side to send data at any time without the overhead of repeated HTTP request/response cycles. WebSockets are the standard mechanism behind live chat, real-time collaborative editing, and live dashboards.

Y

YAML — data serialization format
A human-readable data serialization format, commonly used for configuration files (Kubernetes manifests, CI/CD pipeline definitions, Docker Compose files) because of its indentation-based structure that is easier for humans to read and write than JSON or XML.

Z

Zero-Downtime Deployment — release strategy
A deployment strategy that releases a new version of an application without any period during which users experience an outage or interruption, typically achieved through techniques like rolling deployments (replacing instances gradually), blue-green deployments (running two full environments and switching traffic between them), or canary releases (routing a small percentage of traffic to the new version before a full rollout).