Mobile release analysis glossary

The words this documentation uses, defined once. Where a term has a page of its own, the definition links to it.

Terms

Baseline: A saved set of findings you have already reviewed and accepted. Comparing a scan against it separates what is new in this change from the backlog that already existed. Read more.
Binary analysis: Inspecting the built artefact — the file you are about to ship — rather than the source it was built from. The CLI ships a command group for it; its per-check behaviour is not published. Read more.
Block: A release decision meaning the configured policy found something it treats as release-blocking. It is a policy outcome, not a statement that the application is unsafe. Read more.
Blocker: A finding the configured policy treats as sufficient on its own to hold a release.
CI/CD: Continuous integration and delivery: the automation that builds, tests and ships your application. Guardian runs inside the runner you already control. Read more.
DAST: Dynamic application security testing — analysis of an application while it runs. In Guardian this is not production-ready. Read more.
Dynamic analysis: Observing behaviour that only appears at runtime. Requires a running application in an environment you are authorised to test. Read more.
Evidence: The specific files, configuration or output a finding is based on. A finding without evidence is an opinion.
Existing finding: A finding present in both the current scan and the baseline. It is reported, but it is not what a new-findings gate blocks on.
Finding: One reported issue, with a severity, a location, the evidence behind it and a suggested remediation.
Incomplete coverage: A check that could not run, or evidence that was never supplied. Reported explicitly, and never counted as a pass. Read more.
Local-first: Analysis runs on your machine against a local project path. Nothing is uploaded to run a scan, and no account is involved. Read more.
New finding: A finding in the current scan that is absent from the baseline. This is what `--fail-on-new` blocks on.
Pass: A release decision meaning the policy found nothing release-blocking in the analysis that actually ran. It is not a guarantee that a release is safe. Read more.
Release gate: The step that turns findings, coverage and policy into a single decision a pipeline or a person can act on. Read more.
Resolved finding: A finding present in the baseline but absent from the current scan. The only positive feedback a scanner gives.
Review: A release decision meaning something needs a human before shipping — typically incomplete coverage or a finding the policy does not treat as an automatic block. Read more.
Sanitized finding: A finding reduced to normalized, redacted information with no source, paths or secrets. Nothing leaves your machine today; this is what a future optional integration would carry. Read more.
SARIF: A standard interchange format for static-analysis results. Code-scanning systems ingest it directly, which is why it is the useful format in a pipeline. Read more.
SAST: Static application security testing — analysis of source and configuration without running the application. This is Guardian’s verified surface today.
SBOM: Software bill of materials: the inventory of what your application is built from. The CLI ships a dedicated command group for producing one. Read more.
Severity: How serious a finding is in itself. Distinct from the release decision, which also depends on coverage and on the policy you configured.
Suppression: Recording that a finding is accepted so it stops blocking. A baseline is the supported mechanism today; a richer suppression model with owner and expiry is not built.