FOSS Contribution Risks Catalog
Organizational risks that FOSS contribution policy treats, linked back to Layer 2 threats (source).
Information Protection
Risks involving unauthorized disclosure or loss of sensitive information.
data-leakageDisclosure of Non-Public or Sensitive Information
A contributor may disclose confidential, proprietary, client, customer, security-sensitive, regulated, credential, key, architectural, or other non-public information through a public FOSS contribution.
Could result in regulatory breach, client harm, security exposure, contractual breach, reputational damage, and loss of trust.
foss-contribution-threat-catalogsensitive-data-disclosure
Intellectual Property
Risks involving loss, weakening, or misuse of intellectual property.
intellectual-property-lossLoss or Misuse of Intellectual Property
A contributor may publish company-owned intellectual property, patentable material, trade secrets, trademarks, proprietary methods, or other protected assets without appropriate review or authorization.
Could weaken ownership rights, create patent or licensing complications, expose trade secrets, or impair the organization's ability to protect or commercialize its intellectual property.
foss-contribution-threat-catalogintellectual-property-disclosure
Legal and Compliance
Risks involving legal, license, export-control, or regulatory exposure.
foss-license-non-complianceFOSS License or Contributor Obligation Non-Compliance
A contribution may be made to a project with an unapproved or incompatible license, or under a CLA, CCLA, DCO, or similar contribution agreement that creates unreviewed legal obligations.
Could create legal exposure, incompatible obligations, unexpected patent grants, contribution rights issues, or inability to use or distribute the resulting software.
foss-contribution-threat-catalogunapproved-license-contributioncontributor-agreement-exposure
export-control-non-complianceExport Control or Sanctions Non-Compliance
A project or contribution may involve cryptography, authentication, cross-border collaboration, restricted jurisdictions, sanctioned entities, or other export-control-sensitive functionality without appropriate review.
Could result in breach of export-control, sanctions, or cross-border technology-transfer obligations, with regulatory, legal, and reputational consequences.
foss-contribution-threat-catalogexport-control-violation
Operational Governance
Risks involving governance, conflicts of interest, and process integrity.
conflict-of-interestConflict of Interest in FOSS Contribution Activity
A contributor may participate in a project where personal interests, external roles, commercial relationships, employment obligations, or competing project interests conflict with the organization's interests or decision-making expectations.
Could create governance concerns, impaired decision-making, misuse of company time or resources, inappropriate influence, or loss of confidence in the contribution process.
foss-contribution-threat-catalogemployee-conflict-of-interestungoverned-contribution-activity
Reputation and Conduct
Risks involving reputational harm and inappropriate public conduct.
reputational-damageReputational Damage from Public Contribution Activity
A contributor may behave publicly in a way that is inconsistent with organizational conduct expectations, misrepresent the organization, disclose inappropriate opinions as company positions, or participate in a project whose activity creates reputational risk.
Could damage trust with clients, regulators, open source communities, employees, partners, or the public.
foss-contribution-threat-catalogreputational-harm-from-contributionidentity-misattribution