Truthiness is a programming habit where a value is treated as “true” based on how it is interpreted, not whether it is actually a valid success result. In many languages, non-empty strings, non-zero numbers, and some error objects can evaluate as true unless code checks them explicitly. That makes truthiness convenient in normal application logic, but dangerous in security-sensitive paths.
In cyber security, truthiness bugs often appear in authentication, signature verification, and access-control checks. If a function returns an error code or failure object and the caller tests only whether the return value is truthy, a failed verification can be mistaken for success. Attackers look for this kind of mistake because it can turn a rejected login or invalid token into an authenticated session. Defenders reduce the risk by using strict comparisons, checking exact success values, and treating every unexpected return state as a hard failure.