Glossary

A translation boundary that keeps a new component from adopting a legacy system's data model, terminology, or interface. It allows both systems to communicate during an incremental migration.

A connection that lets a SaaS product and another system exchange data or trigger actions through defined interfaces.

Application rearchitecture changes a system's major component boundaries, responsibilities, data ownership, or interaction patterns. It addresses structural constraints that cannot be removed by an infrastructure move.

Application rehosting moves an existing application to different infrastructure with minimal changes to its code and architecture. It can separate an infrastructure move from later modernization work.

Application replatforming moves software to a different platform while making bounded changes needed to use that platform. The application keeps its main business behaviour and architectural shape.

Application retention keeps an existing system in service because a current requirement, dependency, constraint, or risk makes migration or retirement unsuitable for the defined planning period.

Application retirement removes a system from service after its required capabilities, data, integrations, and records have been moved, replaced, retained elsewhere, or formally discontinued.

Attack surface is the complete set of entry points, interfaces, identities, and dependencies through which a system can be reached or affected.

Authentication is the process a system uses to verify that a user, service, or device is who it claims to be before creating a trusted session.

Authorization is the set of rules that decides which data and actions an authenticated user or service may access.

A boundary within which a domain model and its terminology have a specific meaning. Mapping bounded contexts helps a legacy team separate business capabilities without assuming the current code structure is correct.

A technique for replacing a component behind a shared abstraction while old and new implementations coexist. It allows a large legacy change to be delivered through small steps on the main development line.

A structured comparison between keeping or buying a software product and building a system the business owns.

An automated test that records what existing software currently does. It gives legacy refactoring a behavioural baseline without assuming that every observed result is correct or desirable.

The degree to which parts of a software system depend on each other's implementation or behaviour. Strong coupling can make a local change spread across a legacy codebase.

A part of a codebase that changes frequently and carries significant complexity or defect risk. Hotspot analysis helps an audit focus attention where maintenance pressure and difficult code overlap.

Cross-site request forgery is an attack that causes a user's browser to submit an unintended authenticated request to another site.

Cross-site scripting is a browser vulnerability in which untrusted content is rendered as executable page code within a trusted website.

The timed sequence of decisions and actions used to move users, data, and integrations from a SaaS product to its replacement.

A metric based on the independent paths through a unit of code. In a legacy audit, it helps locate logic that may be difficult to understand, test, and change safely.

A specification that connects data fields, values, relationships, and rules in a SaaS product with their destination in a replacement system.

The controlled transfer of business data from a SaaS product into a new system, including selection, transformation, validation, and cutover.

The checks that confirm migrated data is complete, accurate, connected, accessible, and usable in a SaaS replacement.

Dependency confusion is a software supply-chain attack in which a package manager resolves a dependency name to an unintended package source.

A map of the relationships between modules, services, libraries, and data stores in a software system. It helps a legacy codebase audit reveal what a proposed change can affect.

Dependency pinning constrains a project to specific component versions or verified artifacts so installations and builds resolve predictably.

The exposure a product carries through the third-party packages it depends on. AI-generated code tends to add dependencies quickly, so the surface is usually wider than the team expects.

Input validation checks that data entering a system has the expected type, shape, range, and meaning before the system uses it.

Testing that confirms the replacement and its connected systems exchange data and complete required workflows correctly.

A single deployable application divided into modules with explicit responsibilities and interfaces. It can restore change boundaries inside legacy code without introducing distributed services.

A software application deployed as one unit, with features that share the same release lifecycle. A legacy audit maps its internal boundaries before deciding whether to refactor modules or extract services.

A transition period in which a SaaS product and its replacement operate together so outputs and working procedures can be compared.

Path traversal is a vulnerability in which untrusted path input reaches files or directories outside the location an application intended.

A disciplined change to the internal structure of existing code without changing its observable behaviour. In a legacy codebase, refactoring makes selected areas easier to understand, test, and modify.

A predefined procedure for restoring safe operation in the former SaaS product when a replacement cutover cannot continue.

Secrets management controls how credentials, keys, tokens, and certificates are stored, delivered, rotated, and revoked.

The staged movement of a capability from an existing application into a separately deployed service. It requires a defined boundary, redirected callers, and clear data ownership.

A database that multiple modules or applications access directly. In a legacy migration, shared reads and writes can hide ownership and constrain the order in which capabilities move.

An authentication arrangement that lets users access connected applications through one identity provider session.

The designated authoritative source that other systems and users rely on for a defined set of business information.

A software bill of materials is a structured inventory of the components and dependencies contained in a software product or build.

Software composition analysis identifies the open-source and third-party components in an application and checks their versions, licences, and known security issues.

SQL injection is a vulnerability in which untrusted input changes the structure or meaning of a database command.

An incremental migration pattern that routes selected capabilities from a legacy system to new components until the old implementation can be retired. It avoids replacing the whole system in one release.

The one-time and transitional effort required to move from a SaaS product to another product or to software the business owns.

The accumulated cost of past shortcuts in software. It is the first thing a legacy audit has to measure, and it sits on both sides of a build-versus-buy decision.

Evidence about which parts of a codebase execute during automated tests. It shows where behaviour is protected, but a high number can still verify very little, especially in code generated with AI.

A separate setup where a SaaS replacement and its connections can be checked without changing live business data or workflows.

Threat modeling maps what a system must protect, where trust changes, how misuse could occur, and which controls should prevent or limit it.

The complete cost of acquiring, operating, changing, and eventually leaving a software system over a defined period.

A transitive dependency is a package used indirectly because another dependency requires it, even though the application did not declare it directly.

A documented view of the people, steps, decisions, data, and systems that make up a business process before a SaaS product is replaced.