# Glossary: plain answers on AI and production

Source: https://www.plutonapps.com/resources/glossary

Updated 2026-10-27.

**Glossary** Short answers to the specific questions that come up when a prototype has to become a product.

The Plutonapps glossary is 48 plain-English definitions of the terms that decide whether an AI-built app is ready for real users. Each entry opens with an answer you can quote, then says what the term changes once an app built in Lovable has real users, with sources where there is a fact to check.

## Terms

- [AI app builder](https://www.plutonapps.com/resources/what-is-an-ai-app-builder): An AI app builder is a tool that turns a plain-language description into a working web application, generating the screens, the data model and the logic, and often hosting the result. Lovable, Bolt, v0 and Replit are examples. You change the app by prompting again rather than by editing the code yourself.
- [Audit log](https://www.plutonapps.com/resources/what-is-an-audit-log): An audit log is a permanent, append-only record of the significant actions taken in a system, showing who did what, to which record, when and from where, kept as evidence. Unlike application logs, it must not be editable by the people it records, and auditors rely on it.
- [Authentication vs authorization](https://www.plutonapps.com/resources/authentication-vs-authorization): Authentication is proving who someone is, by password, one-time code or Google sign-in, while authorization is deciding what that signed-in person is allowed to do, such as which records they may read or change. Authentication happens once per session; authorization is checked on every request.
- [Background job](https://www.plutonapps.com/resources/what-is-a-background-job): A background job is a piece of work an application does outside the request a user is waiting on, such as sending an email, resizing an upload or syncing with another service. Jobs wait on a queue for separate workers, which can retry a failure unseen.
- [CI/CD](https://www.plutonapps.com/resources/what-is-ci-cd): CI/CD, short for continuous integration and continuous delivery or deployment, is the automated pipeline that builds and tests every change to an app, then releases each change that passes, either at the push of a button or automatically. It makes releasing routine instead of risky.
- [Code audit](https://www.plutonapps.com/resources/what-is-a-code-audit): A code audit is a structured review of a whole codebase by experienced engineers, looking for security holes, reliability risks and code that will be hard to change. It ends in a written list of findings ranked by risk. Unlike a code review, which checks one change before it merges, a code audit looks at everything that already exists.
- [Code handover](https://www.plutonapps.com/resources/what-is-a-code-handover): A code handover is the transfer of software from one team to another, including the code and its history, the accounts it runs on, the secrets, the documentation and the knowledge of how it is released. A complete code handover lets the new team ship a change without calling the old one.
- [Data processing agreement (DPA)](https://www.plutonapps.com/resources/what-is-a-data-processing-agreement): A data processing agreement (DPA) is the contract required by Article 28 of the GDPR between a controller, the business that decides why personal data is used, and a processor that handles that data on its behalf. It sets out what is processed, why, how it is secured and which subprocessors are used.
- [Database index](https://www.plutonapps.com/resources/what-is-a-database-index): A database index is a separate lookup structure, kept by the database, that lets it find the rows matching a condition without reading the whole table, much like the index at the back of a book. Indexes make reads fast, but every write must update them too.
- [Development subscription](https://www.plutonapps.com/resources/what-is-a-development-subscription): A development subscription is a way of buying software engineering as a flat monthly plan for reserved engineering capacity, instead of paying by the hour or agreeing a fixed price for each project. You send requests continuously and the team works through them in priority order. Plans can usually change each billing period.
- [End-to-end testing](https://www.plutonapps.com/resources/what-is-end-to-end-testing): End-to-end testing checks a complete user journey through the running application the way a customer would, with a script driving a real browser to sign up, create something, pay and see the result. It touches the interface, server, database and outside services together. Playwright and Cypress automate it.
- [Feature flag](https://www.plutonapps.com/resources/what-is-a-feature-flag): A feature flag is a switch in an application's configuration that turns a feature on or off, for everyone or for chosen users, without deploying new code. Teams use feature flags to release gradually, test with a few customers first, and switch off a misbehaving feature in seconds instead of rolling back a whole release.
- [Fractional CTO](https://www.plutonapps.com/resources/what-is-a-fractional-cto): A fractional CTO is an experienced technology leader who works for a company part time to set technical direction: architecture and stack, reviews of what has been built, engineering hiring and advice to founders and investors. It gives a startup senior judgment without a full-time executive salary, often for a few days a month.
- [Idempotency](https://www.plutonapps.com/resources/what-is-idempotency): Idempotency is the property of an operation that has the same effect whether it runs once or many times, so a retry, a double click or a redelivered webhook cannot charge a card or send an email twice. It is usually enforced with an idempotency key the server remembers.
- [Incident response](https://www.plutonapps.com/resources/what-is-incident-response): Incident response is the plan a team follows when something goes wrong in production, such as an outage, a data leak or a bad release, decided in advance rather than improvised. It covers noticing, choosing who leads, containing damage, restoring service, telling those affected and learning from it.
- [Load testing](https://www.plutonapps.com/resources/what-is-load-testing): Load testing is running an application under a realistic, simulated volume of users or requests to measure how it performs: response times, error rates and where it slows down. A stress test pushes beyond expected load to find the breaking point. Both are run on a production-like environment before a launch or a campaign, not discovered during one.
- [Lovable Cloud](https://www.plutonapps.com/resources/what-is-lovable-cloud): Lovable Cloud is the backend built into Lovable: the database, user sign-in, file storage and server-side functions your app needs, created and managed from inside the Lovable editor. It is built on Supabase's open-source foundation and is enabled by default, so most Lovable projects never need a separate Supabase account.
- [Minimum viable product (MVP)](https://www.plutonapps.com/resources/what-is-an-mvp): A minimum viable product (MVP) is the smallest complete version of a product that real users can get real value from without the founder beside them: one kind of user, one journey, finished properly. It is not a cheap version of everything, and not a demo, but a real version of one thing.
- [Model Context Protocol (MCP)](https://www.plutonapps.com/resources/what-is-mcp): The Model Context Protocol (MCP) is an open standard that lets AI assistants such as Claude, ChatGPT or Cursor discover and call an application's tools and read its data on a user's behalf, through an MCP server. Anthropic introduced it in November 2024; it uses JSON-RPC 2.0.
- [Multi-factor authentication (MFA)](https://www.plutonapps.com/resources/what-is-multi-factor-authentication): Multi-factor authentication (MFA) is a sign-in method that requires two or more different kinds of proof: something you know, such as a password, something you have, such as a phone, or something you are. A stolen password alone is then not enough to get in.
- [Multi-tenancy](https://www.plutonapps.com/resources/what-is-multi-tenancy): Multi-tenancy is a software design in which one running application and its database serve many customers, called tenants, while each tenant sees only its own data. It is how most SaaS products work, and it depends on every query being scoped to the right tenant.
- [OAuth](https://www.plutonapps.com/resources/what-is-oauth): OAuth 2.0 is an open standard that lets an app get limited access to a user's account on another service, such as their Gmail or calendar, without ever seeing their password. The user approves specific permissions, called scopes, and the app receives a token it can use until it expires or is revoked.
- [Observability](https://www.plutonapps.com/resources/what-is-observability): Observability is the ability to understand what a running system is doing, and why, from the data it emits: logs of events, metrics such as error rates, and traces that follow one request through every service. Monitoring watches for predicted problems; observability explains the rest.
- [Penetration test](https://www.plutonapps.com/resources/what-is-a-penetration-test): A penetration test is an authorized, simulated attack on an application or system in which security testers try to exploit weaknesses the way a real attacker would, then report what they reached. Unlike an automated scan, it proves which weaknesses can actually be used.
- [Point-in-time recovery (PITR)](https://www.plutonapps.com/resources/what-is-point-in-time-recovery): Point-in-time recovery (PITR) is a way of restoring a database to its exact state at any chosen moment, such as one minute before a bad deploy, rather than only to the last scheduled backup. It replays a continuous record of changes on top of a base backup.
- [Product engineering](https://www.plutonapps.com/resources/what-is-product-engineering): Product engineering is the work of turning a software product idea into a system people can rely on, then keeping it reliable: architecture, data, security, testing, releases and running the live service. The product's users and goals decide the trade-offs. It covers the whole lifecycle, not only writing code to a specification.
- [Production-ready](https://www.plutonapps.com/resources/what-does-production-ready-mean): Production-ready describes software that is safe to put in front of real users because access is enforced, changes are tested, releases can be rolled back, failures raise alerts and data can be restored. It is a checkable state of the system, not a judgment about how finished the app looks.
- [Rate limiting](https://www.plutonapps.com/resources/what-is-rate-limiting): Rate limiting is a control that caps how many requests a user, API key or IP address can make in a set period, such as 100 per minute, and refuses the rest; slowing them instead is called throttling. It protects an app from abuse, brute-force logins, runaway scripts and unexpected bills.
- [Refactoring](https://www.plutonapps.com/resources/what-is-refactoring): Refactoring is restructuring the internal design of existing code without changing what it does for the user, done in small steps that each keep the software working and easier to change. It is how technical debt is paid down, and it depends on automated tests to prove that behavior stayed the same.
- [Regression testing](https://www.plutonapps.com/resources/what-is-regression-testing): Regression testing is re-running a suite of existing automated tests after every change to an app, to confirm that features which already worked still work and that a fix in one place has not broken another. A regression is something that used to work and broke.
- [Role-based access control (RBAC)](https://www.plutonapps.com/resources/what-is-role-based-access-control): Role-based access control (RBAC) is a way of managing permissions in which rights are granted to roles, such as owner, admin, editor or viewer, and people are given roles. Changing what a role may do changes it for everyone in that role, without editing each person one by one.
- [Row-level security (RLS)](https://www.plutonapps.com/resources/what-is-row-level-security): Row-level security (RLS) is a database feature that decides, row by row, which users may read or change data, through policies the database enforces on every query. Because the database applies the rule, it holds however a request arrives: through your app, a direct API call or someone else's script.
- [Schema migration](https://www.plutonapps.com/resources/what-is-a-schema-migration): A schema migration is a versioned script that changes the structure of a database, such as adding a table, a column or an index, kept in the code repository and applied in order to every environment. Because each change is a file, staging and production change the same way.
- [Secrets management](https://www.plutonapps.com/resources/what-is-secrets-management): Secrets management is the practice of keeping an application's credentials, such as API keys, database passwords and OAuth tokens, out of code and out of the browser. Secrets are stored encrypted, given only to services that need them, rotated after a leak, and audited.
- [Single sign-on (SSO)](https://www.plutonapps.com/resources/what-is-single-sign-on): Single sign-on (SSO) lets people sign in to many applications with one login, usually their company account at an identity provider such as Okta, Microsoft Entra ID or Google Workspace. Your app trusts that provider through SAML or OpenID Connect, so the customer's IT team controls who can access your product.
- [SLA vs SLO vs SLI](https://www.plutonapps.com/resources/sla-vs-slo-vs-sli): SLA vs SLO vs SLI is the chain from measurement to promise: an SLI measures how a service performs, an SLO sets the target for that measure, and an SLA promises customers that level in a contract, with consequences. For example, 99.9% of requests succeeding over 30 days.
- [SOC 2](https://www.plutonapps.com/resources/what-is-soc-2): SOC 2 is a report in which an independent CPA firm examines whether a company's controls protect customer data, measured against the AICPA's criteria for security, availability, processing integrity, confidentiality and privacy. A Type 1 report checks control design at one date; a Type 2 report checks the controls worked over months.
- [Staff augmentation](https://www.plutonapps.com/resources/what-is-staff-augmentation): Staff augmentation is hiring engineers from an outside company to work inside your own team, under your management and day-to-day direction, for as long as you need the extra capacity. You skip recruiting, but you still make the technical decisions and carry responsibility for the result. It suits companies with engineering leadership.
- [Staging environment](https://www.plutonapps.com/resources/what-is-a-staging-environment): A staging environment is a private copy of your production system, with the same code, configuration and kind of data, where each release is deployed and checked before real users see it. If a change breaks on staging, it would have broken in production, and you found out without any customer being affected.
- [Supabase](https://www.plutonapps.com/resources/what-is-supabase): Supabase is an open-source backend platform built on PostgreSQL that gives an app a Postgres database with an instant API, user sign-in, file storage, realtime updates and server-side functions in one project. Lovable Cloud, Lovable's built-in backend, is built on Supabase's open-source foundation.
- [Supabase anon key vs service role key](https://www.plutonapps.com/resources/supabase-anon-key-vs-service-role-key): The Supabase anon key (now called the publishable key) identifies your app and is safe to ship in the browser, because row-level security decides what it can reach. The service role key (now the secret key) bypasses row-level security entirely, so it belongs only on a server and must never appear in client code.
- [Technical co-founder](https://www.plutonapps.com/resources/what-is-a-technical-co-founder): A technical co-founder is a founder who takes responsibility for building the product: its architecture, its code and, later, its engineering team, usually in exchange for a significant share of the company rather than a salary. Investors often look for one because it shows the team can build and keep building what it sells.
- [Technical debt](https://www.plutonapps.com/resources/what-is-technical-debt): Technical debt is the extra cost you pay later for shortcuts taken in software now: code that works but is hard to change, missing tests, duplicated logic, decisions nobody wrote down. Like financial debt, it charges interest, because every future change takes longer, until the shortcut is paid down by refactoring. Ward Cunningham coined the term in 1992.
- [The real product](https://www.plutonapps.com/resources/what-is-the-real-product): The real product is the live, engineered version of the app you design in Lovable: the software your customers actually use, which Plutonapps engineers build, test, release and support while you keep designing. When a Lovable version is right you send it to us, and after release it syncs back.
- [Vendor lock-in](https://www.plutonapps.com/resources/what-is-vendor-lock-in): Vendor lock-in is the situation where leaving a software supplier, platform or agency would cost so much time, money or risk that you effectively cannot. It comes from code you cannot export, data only one platform reads, or accounts in the supplier's name. Owning the repository, data and accounts avoids it.
- [Vibe code cleanup](https://www.plutonapps.com/resources/what-is-vibe-code-cleanup): Vibe code cleanup is the engineering work that makes an AI-generated app safe and maintainable: closing security gaps, putting access rules in the database, adding tests and removing duplicated code. It keeps what works and replaces what cannot be trusted, rather than rewriting the app from scratch.
- [Vibe coding](https://www.plutonapps.com/resources/what-is-vibe-coding): Vibe coding is building software by describing what you want to an AI in plain language and accepting the code it writes, judging the result by whether it works rather than by reading the code. The term was coined by Andrej Karpathy in February 2025 and named Collins Word of the Year 2025.
- [Webhook](https://www.plutonapps.com/resources/what-is-a-webhook): A webhook is an HTTP request that one service sends to a URL in your app when something happens on its side, such as a payment succeeding or an email bouncing. Instead of your app asking repeatedly, the other service tells it. Stripe, Clerk and Resend all use webhooks.