Threat icons

The 61 threat icons in Security, described

Attack surfaceattack-surface

The wide machine with two arrows landing on a surface — everything an attacker can touch.

Auth bypassauth-bypass

An open lock with an arrow walking through it — the login step skipped altogether.

Breachbreach

A breach — attackers got in, a compromise of the system or a leak of data.

Broken access controlbroken-access

An open lock with someone inside it — a user reaching what was not theirs to reach.

Bug bountybug-bounty

A shield with a coin in it — a reward for the flaw reported the right way.

Clickjackingclickjacking

A panel with a cursor in it — a click landing on something the user could not see.

Content security policycontent-security-policy

A window with a shield in it — the page told exactly what it may load.

Credential leakcredential-leak

An open lock with the key still in it — a password or token that got out.

CSRF tokencsrf-token

A panel with a coin in it — the token a form carries to prove it came from this site.

CVE advisorycve-advisory

A shield with a tag in it — a published flaw, with its number.

Data exfiltrationdata-exfiltration

Data exfiltration — data that left the system when it should not have, a leak.

DDoSddos

A DDoS attack — a flood of traffic from many sources meant to overwhelm a service.

Defence in depthdefence-in-depth

A shield with a shield inside it — more than one layer between the attacker and the data.

Dependency confusiondependency-confusion

The wide machine with two packages and a cross between them — the public one picked over the private one.

Deserialisation flawdeserialisation-flaw

A bolt landing in a tray — data unpacked into an object that does something on arrival.

Exploitexploit

An exploit — the particular attack payload that uses a vulnerability to get in.

Exploit PoCexploit-poc

A panel with a prompt and a bolt — the proof that a flaw can actually be used.

Fail securefail-secure

A shield with a lock in it — when something breaks, it breaks closed.

Hardcoded secrethardcoded-secret

A page with a key on it — a credential written straight into the source.

Header injectionheader-injection

A panel with a header line and a bolt under it — a line break smuggled into a header.

IDORidor

An open lock with a hash in it — an object reached by guessing its id.

Injection flawinjection-flaw

The wide machine with an arrow pushed into a box — input treated as an instruction.

Input validationinput-validation

The wide machine with a funnel in it — input checked before the server takes it.

Insecure randominsecure-random

An open lock with a wobbling line in it — randomness an attacker can predict.

Intrusionintrusion

An intrusion — something unauthorised got through, a breach or an attack.

Malwaremalware

Malware — hostile software that works against you, a virus or a payload.

Mass assignmentmass-assignment

An open lock with a list in it — every field in the request written straight to the model.

Open CORSopen-cors

An open lock with an arrow pointing both ways — any origin allowed to read the response.

Open redirectopen-redirect

A panel with a path that turns off somewhere else — a link that sends users where it likes.

Output encodingoutput-encoding

A shield with angle brackets in it — text made safe before the page shows it.

OWASP listowasp

A clipboard with a bulleted list — the flaws that come up most.

Parameterised queryparameterised-query

A shield with a value threaded on a line — the value bound in, never pasted into the query.

Patch windowpatch-window

A shield with a bracketed span in it — the time allowed to fix a known flaw.

Path traversalpath-traversal

A folder with two chevrons climbing out of it — a path that walks up past where it should.

Pentestpentest

A shield with an arrow aimed into it — an attack run on purpose, by people you asked.

Phishingphishing

Phishing — the hook waiting for a bite, a scam lure disguised as something trusted.

Quarantinequarantine

Quarantine — held apart where it can do no harm, flagged and isolated.

Race conditionrace-condition-sec

The wide machine with two arrows racing — two requests arriving so close that a check is skipped.

RASPrasp

The wide machine with a shield in it — protection that runs inside the application itself.

Responsible disclosureresponsible-disclosure

A shield with an arrow that turns and is handed on — a flaw told to the people who can fix it, first.

Sandbox escapesandbox-escape

A box inside a box with an arrow climbing out of the inner one — code reaching past its walls.

Security scanscan-security

A security scan — a sweep looking for vulnerabilities, CVEs and misconfigurations.

Security championsecurity-champion

A person with a shield on the chest — the one on the team who carries security.

Security headersecurity-header

A panel with a header line and a check under it — the headers a response carries to protect the page.

Security review gatesecurity-review-gate

A shield with a bar across it — nothing ships until security has looked.

Session fixationsession-fixation

An open lock with a pin in it — a session id planted before the user ever logged in.

Shield alertshield-alert

Shield alert — the safety policy caught something, a risk or a violation to review.

Side channelside-channel

An open lock with a signal in it — a secret read from power, cache or sound.

SQL injectionsql-injection

The database cylinder with a bolt in it — a query with an attacker's text in it.

SSRFssrf

The wide machine with an arrow that loops back into it — the server made to fetch something for the attacker.

STRIDEstride-model

A window ruled into columns — threats sorted by kind.

Subresource integritysubresource-integrity

A page with a hash on it — a script only loaded if its hash matches.

Supply chain attacksupply-chain-attack

The delivery truck with a bolt in its cargo — something planted before it reached you.

Threat modelthreat-model

A page with a decision diamond and a path out — what could go wrong, worked out before it does.

Timing attacktiming-attack

An open lock with a clock in it — a secret read from how long a check takes.

Typosquattyposquat

A page with a line that ends in a wrong character — a package named one letter off the real one.

Vulnerabilityvulnerability

A vulnerability — a flaw that offers a way in that should not be there, a weakness to exploit.

WAF rulewaf-rule

A shield with bricks in it — a rule the firewall applies to every request.

Weak cryptoweak-crypto

An open lock with a cross in it — a cipher or hash that no longer holds.

XSSxss

A panel with a tag and something planted in it — script slipped into a page others will load.

XXExxe

A page with a tag and a bar in it — an XML entity that reads files it should not.

In code, each is one import — import { AttackSurface } from "@iconmind/react/icons/attack-surface" — and the same name in Vue, Svelte, Solid, Preact, React Native, Astro, Blade and Flutter.

Narrow it by tag