VCE Software Development U4O2 Word Scramble: Vulnerabilities and risks in insecure development environments and Third-party software, code review and combined environments (Modules 23–47)
Name:
Date:
Class:
🔤
Word scramble
Unscramble the letters and write each key term on the line.
1
PAI
Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.
2
PIA RTIYUCSE ISKR
An API is risky when it lacks authentication, input validation or rate limits, so attackers can send requests straight to it and steal data or misuse it.
3
ROAD-HDECD TERECS
A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.
4
NHUAECPTD WAFTROES
Software missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data.
5
EHL-IE-MTN-DNIDMA CATKTA
An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.
6
MBDCOENI MEVNIETNNOR
One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.
Answer Key
VCE Software Development U4O2 · Modules 23–47
1PAI → API — Application programming interface: a set of defined requests that lets one piece of software use the data or functions of another, such as sending a request and getting a response back.
2PIA RTIYUCSE ISKR → API security risk — An API is risky when it lacks authentication, input validation or rate limits, so attackers can send requests straight to it and steal data or misuse it.
3ROAD-HDECD TERECS → hard-coded secret — A key, password or token written directly into source code. Anyone who can read the code or its repository can steal it, and deleting the file later does not remove it from the history.
4NHUAECPTD WAFTROES → Unpatched software — Software missing security updates, so known flaws stay open. In a dev environment, attackers can use them on developer machines or build servers to reach code and data.
5EHL-IE-MTN-DNIDMA CATKTA → man-in-the-middle attack — An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.
6MBDCOENI MEVNIETNNOR → combined environment — One shared environment used for development, testing and production, so untested code and live data mix and mistakes or attacks can reach real users and data.