a set of concepts describing a database's structure, operations, and constraints
a set of concepts to describe the structure of a database, the operations for manipulating those structures, and certain constraints that the database should obey, provides data abstraction
term for when a scan fails to find real vulnerabilities. leaves unidentified risk in the code.