Glossary

mTLS

mTLS

Mutual Transport Layer Security

TLS in which both parties present certificates. Authenticating the client still needs an authorization decision about allowed operations.

Multi-factor authentication

MFA

Multi-Factor Authentication

Authentication using different factor categories, such as a password and hardware key. Multiple passwords are not automatically multiple factors; recovery procedures matter too.

Multiversion concurrency control

MVCC

Multiversion Concurrency Control

Concurrency control using data versions. Reads can see a transaction-defined snapshot, but write conflicts and isolation levels still matter.

Mutation testing

Deliberately introducing a small fault and checking whether a test detects it. A test that also passes for the faulty variant may not protect that rule. Detecting selected mutations does not prove complete program correctness.

N+1 query problem

One list read triggers an additional query per item. Detect it with query counts and choose relation fetching deliberately; a single large JOIN also needs measurement.

Naive datetime

A datetime without enough information to determine a UTC offset unambiguously. 10:00 alone does not identify a global instant. Do not attach a timezone without understanding the data contract; relabeling and converting the same instant are different operations.

Namespace

A logical scope for names and objects, such as in Kubernetes. It organizes resources but is not an isolation boundary by itself without policies and permissions.

NAT Gateway

Managed address translation. A public NAT gateway lets private IPv4 resources initiate internet connections; it does not automatically expose them to new inbound internet connections.

NestJS

A TypeScript framework organizing modules, controllers and providers. A Fastify adapter handles HTTP; it does not replace NestJS container concepts.

Network ACL

NACL

Network Access Control List

Stateless rules at a VPC subnet boundary. Account for both directions and response ports. This differs from stateful security groups.

Network address translation

NAT

Network Address Translation

Network-address translation, used for purposes such as outbound traffic from private subnets. It does not replace application security policy; cloud cost and availability also matter.

A private backend initiates a payment-provider connection through NAT; that does not grant new inbound access to the backend.

NetworkPolicy

A declaration of allowed traffic for selected Kubernetes Pods. It needs a supporting network implementation and connectivity tests; YAML alone does not prove isolation.

New Relic

An APM platform that collects data through a configured agent and shows transactions and slow segments. Having an agent does not guarantee a complete trace for every request.

Node.js

A JavaScript runtime outside the browser. Its event loop helps handle I/O, but heavy computation on that thread blocks other work.

Nullish coalescing

JavaScript ?? selects a fallback only for null or undefined. Unlike ||, it preserves valid zero, false and empty text. Other languages have their own absence contracts.

NullPointerException

NPE

NullPointerException

A JVM exception when an operation requires an object but the reference is null. Locate the contract violation rather than merely hiding the exception.

OAuth 2.0

OAuth names an authorization framework. It does not mean Open Authentication; OpenID Connect defines an authentication layer.

A framework for delegated client authorization without sharing the user’s password. OAuth alone does not define a complete user-login protocol; OIDC commonly provides that layer.

Object-relational mapping

ORM

Object-Relational Mapping

A layer connecting language objects to relational database records. It assists reads and writes but does not remove the need to understand SQL, transactions, indexes or query costs.

Observability

The ability to explain system state from its signals. Choose logs, metrics and traces for operational questions; data volume alone does not guarantee diagnosis.

Observed state

State read from resources and reports at a point in time. It may lag behind a change and requires interpretation of readiness conditions.

Observer

Notifies registered listeners of an event or change. Specify ordering, unsubscribe and failure policy; an in-memory listener list does not guarantee durable delivery.

OCP

OCP

Open/Closed Principle

Extend a known variation without rewriting its stable client. Do not build plugins for hypothetical requirements.

Off-by-one error

A boundary error that processes one element too few or too many. Three elements have indices 0, 1 and 2; index 3 is out of range. Tests for an empty collection, one element and the final element help expose this mistake.

Open Container Initiative

OCI

Open Container Initiative

Open standards covering image formats and container execution, among other areas. Artifact-format compatibility does not ensure configuration compatibility or environment security.

Open Session in View

OSIV

Open Session in View

A pattern keeping ORM context available during web response handling. It can hide lazy queries outside the use-case transaction; inspect boundaries and query counts.

Open Source Software

OSS

Open Source Software

Software distributed under a license meeting open-source criteria. Accessible code does not imply no license obligations or guaranteed support.

OpenAPI

A specification describing HTTP operations, parameters, schemas and responses. It supports documentation and client generation, but a file alone does not prove server conformance.

OpenID Connect

OIDC

OpenID Connect

An authentication layer over OAuth 2.0. An ID Token tells the client about user identity; it is not automatically an access token for arbitrary APIs.

OpenTelemetry

OTel

OpenTelemetry

OTLP

OpenTelemetry Protocol

Standards and tooling for instrumentation and telemetry export. OTLP transports signals; an SDK alone does not provide useful alerts or data storage.

Operating System

OS

Operating System

The layer managing processes, memory and devices. Commands, paths and signals can differ across Linux, macOS and Windows.