Vector
Attack vectors and techniques used to compromise information systems.
Role
Vectors name the pathways through which harm can arrive. In a contribution programme they are not abstract MITRE IDs alone—they are concrete ways an employee contribution can go wrong: an accidental sensitive commit, an unreviewed public release, or contribution under the wrong identity. Guidance cites them; threats treat them as attack paths.
Examples
Accidental commit of sensitive information
A contributor inadvertently includes credentials, client data or internal hostnames in a public commit or issue. The vector names the pathway; later threats and controls reason about disclosure risk along that path.
Source: Accidental Commit of Sensitive Information (accidental-sensitive-commit) in FOSS Contribution Vector Catalog.
Unreviewed public release
Material reaches a public repository before information-classification, export-control or IP review completes. The pathway is premature publication—not the control that would have caught it.
Source: Unreviewed Public Release (unreviewed-public-release) in FOSS Contribution Vector Catalog.
Improper company-identity attribution
Contribution is performed under a company-associated identity when the activity should have been personal—or the reverse—creating a pathway for misattributed legal and reputational exposure.
Source: Company Identity Misuse (company-identity-misuse) in FOSS Contribution Vector Catalog.
Links upstream
- Incident history, threat intelligence and operational anecdotes that name pathways
- Shared lexicon terms for pathway language
Links downstream
Anti-patterns
Vectors that are really threats
“Data leakage” is an organisational threat or risk. “Accidental sensitive commit” is a vector—the pathway that enables the threat.
Generic vectors with no applicability
A catalogue of techniques that never say which contribution categories or systems they apply to. Pathways without scope cannot inform controls.