Glossary

Quick check: A free look at one homepage, with a score out of 100 and a grade from A to D in about ten seconds. No account needed, and it uses no scan.
Pulse: The free scan for signed-in accounts. It usually takes under 15 seconds and looks at your homepage, email settings, security settings and public records the way a stranger or a bot would.
Deep scan: The deeper scan. It walks through up to 30 pages of your site the way a determined attacker would, and needs proof that you own the site.
Master Key: A test that signs in to your app with two test accounts to check whether one user can see another user's data. Coming soon.
Auto-check: A scan Lockpick runs for you on a schedule, every week on the Free and Deep plans, with the result emailed to you.
Scans left: What remains of this month's scans on your plan. The CLI and the API still call them credits.
Bonus scans: Scans you get on top of your plan, for example for inviting a friend or from early access. They show separately from your plan's scans.
Grade: A letter from A to D that sums up how exposed your site is, from a score out of 100.
Thing to fix: Something a scan found that makes an attack easier. Developers call it a finding.
Severity: How much a thing to fix matters, on one scale. Critical, High, Medium, Low or Info. Pulse and Deep rate up to High today, and Monitor advisories can be Critical.
When to fix: How soon to deal with a finding. Fix now means customer data, accounts or keys can be reached. Fix this week means someone could use it against you. When you can means it makes an attack easier. Nothing to do means it is only worth knowing. For a skill, plugin or MCP server you are deciding whether to install, the same levels read Don't install yet, Check before installing, Worth knowing and Nothing to do.
Evidence: What the scan actually saw that shows the problem, such as a header or a public record, with anything sensitive hidden.
Coverage: What a scan was able to check. Anything it could not check is never counted as passed.
Built in the browser: A site whose pages are put together by code running in the visitor's browser, as many React apps are. Pulse reads what your server sends, so it sees less of these sites, and the report's Scope tab says what it left out.
Check again: A new scan of the same kind on the same site, compared with the one before. It always uses one scan. The CLI calls it a recheck.
Re-read this record: A free, instant re-read of your public DNS, certificate and registration records for one issue. It sends nothing to your site and uses no scan.
Prove you own your site: The one-time step Deep needs. You add a DNS record, a meta tag or a file that only the site's owner can publish, and Lockpick looks for it before every Deep scan.
Attestation: Your confirmation that you own a site or are allowed to test it. Lockpick asks for it before every scan.
Monitor: Lockpick watching published security problems in the software your sites use, such as Next.js or WordPress, and telling you when one may matter to you.
Advisory: A public notice about one security problem in a piece of software, usually naming the release that fixes it.
May affect you: Your site uses the software an advisory is about, but we can't see which version. If your site already runs a fixed release, nothing needs to change.
Affects you: The package versions you sent Lockpick include an affected release. Update to the release the advisory names.
Actively exploited: Attackers are already using this problem against real sites. Deal with these first.
KEV: CISA's Known Exploited Vulnerabilities list. CISA is the US government's cyber security agency, and its list names problems attackers are using right now.
CVE and GHSA: Public ids for one known security problem, such as CVE-2025-55182. A GHSA id is GitHub's id for the same kind of notice. You only need them to look a problem up.
RCE: Remote code execution. A problem that lets an attacker run their own code on your server, one of the most serious kinds.
Public records: Facts about your domain that anyone can look up, such as its DNS records, certificate logs and registration details. They have nothing to do with court or government records.
DNS: The internet's address book. It says where your site and your email live, and anyone can read it.
Subdomain: An address under your domain, such as shop.example.com under example.com. Certificate logs list them, so anyone can find them.
TXT record: A DNS record that holds a line of text. Email security settings and ownership proofs use them.
SPF: A DNS record that lists which servers may send email as your domain.
DKIM: A signature on your emails that proves they really came from your domain.
DMARC: A DNS record that tells mail providers what to do with email that fails SPF or DKIM, such as reject it.
HTTPS certificate: What lets browsers connect to your site privately and check it is really yours. Every certificate is listed in public logs.
Security headers: Instructions your site sends with every page that tell browsers to block common attacks.
Content Security Policy: A security header that tells browsers which scripts may run on your page.
HSTS: A security header that tells browsers to only ever use HTTPS for your site.
CORS: The rules that decide which other websites may read data from your site in a visitor's browser.
Source map: A file that turns your site's compressed code back into readable source. Left public, it can show how your app works.
Exposed file: A file that should never be public, such as a settings file or a backup, that anyone can download.
Subdomain takeover: When a subdomain still points at a service you stopped using, so someone else can claim it and show their own page.
robots.txt: A file on your site that tells automated visitors which pages to skip. Lockpick follows it for every page it discovers, and still reads the page a visitor opens and the files it loads.
User agent: The name a program gives when it visits your site. Lockpick's scans send an ordinary browser's, and prove they are Lockpick with a signed Signature-Agent header instead.
Repair brief: All of a scan's fixes in one document, written for a developer or a coding assistant.
Fix prompt: Instructions for one fix that you paste into a coding assistant such as Claude Code or Cursor. Each thing to fix has its own, and you can edit it before you copy it.
MCP: The Model Context Protocol, the standard AI assistants use to connect to tools like Lockpick.
OAuth: The standard way to let an app act for you without giving it your password. Assistants sign in to Lockpick with it.
CLI: Lockpick for your terminal, the lockpick command, installed from npm as lockpicks.
API key: A secret, like a password for a program, that lets software use an account on another service. Lockpick's own API key lets the CLI or your release scans use your Lockpick account. The CLI gets one when you sign in.
Projects and runs: The CLI, the API and some web addresses still say project for a site and run for a scan. They mean the same things.