> ## Documentation Index > Fetch the complete documentation index at: https://docs.vidocsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Glossary > The terms that this documentation and the Vidoc web app use. | Term | Definition | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent | An LLM program that does a task in steps. It reads files, searches the code, and then gives a result. Vidoc uses agents for the threat model, detection, validation, and answers in pull requests. | | API key | A secret token that the `vidoc` CLI and scripts send to the Vidoc API. A user creates it in the web app. Refer to [API authentication](/api/authentication). | | Attack vector | A CVSS term: the path by which an attacker can get to the vulnerable code. The values are Network, Adjacent, Local, and Physical. The validation agent sets it for each finding that it validates. | | Compliance category | A finding category about a weak practice more than a direct attack, for example weak cryptography, hardcoded secrets, or sensitive data logging. The web app shows these findings as **Data & Compliance**. Vidoc does not write PR comments for them. Refer to [Security categories](/reference/security-categories). | | CWE | Common Weakness Enumeration. A public list of software weakness types. Each finding has a CWE ID. | | Default branch | The branch that Vidoc uses as the reference for full scans, usually `main`. The web app shows it as **Source branch**. | | Detection | The scan step in which LLM agents read the code and report possible security issues. Detection does not use learnings. | | False positive | A finding that is not a real security issue. It is also a validation verdict, and a status that a user can set on a finding. | | Finding | A possible security issue that Vidoc reports. It has a title, a location in the code, a severity, a category, a CWE, and a status. | | Full scan | A scan of all files of a branch, usually the default branch. Refer to [How Vidoc works](/how-it-works#scan-types). | | Learning | A rule that Vidoc creates from feedback on one finding: a status change with a reason, or a developer reply on a PR comment (GitHub and GitLab only). The validation agent uses learnings. A learning can make validation mark a similar finding as a false positive, so Vidoc does not report it. Detection does not use learnings. | | Memory (page) | The page in the web app that shows all learnings and memory entries. Users with the Security Engineer role or higher can supersede and reactivate entries, and edit learnings, there. Refer to [Memory](/web-app/memory). | | Memory entry | A general fact about your code or your policy that a developer teaches the bot in a PR mention (GitHub and GitLab only), for example "remember that all admin endpoints are behind the VPN". It is not linked to one finding. | | Merge request (MR) | The GitLab name for a pull request. This documentation uses "pull request" and "PR" for all platforms. | | PR scan | A scan of the changes in a pull request. Refer to [Pull request reviews](/pull-requests/overview). | | Pull request (PR) | A request to merge the changes of one branch into another branch. GitLab calls it a merge request (MR). This documentation uses "pull request" and "PR" for all platforms. | | Revalidation | A new validation of a finding that Vidoc confirmed before, for example when the code of the finding changed. If revalidation does not confirm the finding again, Vidoc closes it. | | SCA | Software composition analysis. Tools that compare the versions of your third-party libraries with vulnerability databases. Vidoc does not do SCA. | | SCM | Source code management system. In this documentation: the source code platform. The Vidoc web app uses "SCM", for example in **SCM usernames**. | | Severity | The risk level of a finding: critical, high, medium, low, or informative. | | Source code platform | The system that keeps your Git repositories and pull requests: GitHub (github.com), GitLab (GitLab.com or self-managed), or Bitbucket (Cloud or Data Center). Refer to [Supported platforms](/supported-platforms). | | Supersede | To stop the use of a learning or a memory entry. Vidoc keeps a superseded entry for audit, but validation does not use it. A user can reactivate it. | | Support bundle | A JSON file with the technical data of one scan. On a self-hosted installation, an admin downloads it from the **Scans** panel and sends it to Vidoc support. | | Threat model | A description of the architecture of a repository, its assets, and its attack surface. The agents use it as context. | | True positive | A finding that is a real security issue. It is also the validation verdict that Vidoc needs before it reports a finding. | | Validation | The scan step in which an agent reads the code to confirm a finding. The verdict is true positive, false positive, or unknown. Validation runs for high and critical findings and for findings that need revalidation. | | Verdict | The result of validation: true positive, false positive, or unknown. | | Vidoc app or bot account | The identity that Vidoc uses on your source code platform. Vidoc reads repositories and writes PR comments as this identity. GitHub: the Vidoc GitHub App. GitLab: a bot user. Bitbucket: the account of the access token. On GitHub, developers mention `@vidoc` in PR comments (the summary comment shows the handle to use). On GitLab, developers mention the bot username. Refer to [Commands](/pull-requests/commands). | | Webhook | An HTTP request that your source code platform sends to Vidoc when an event occurs, for example when a PR changes. On GitHub and GitLab, Vidoc creates the webhook automatically. On Bitbucket, an admin creates it manually. |