FOSS Contribution Vectors Catalog
Attack vectors and exploitation pathways for FOSS contribution threats (source).
Public Publication
Vectors involving publication of code, documentation, or communications to public FOSS platforms.
accidental-sensitive-commitAccidental Commit of Sensitive Information
A contributor inadvertently includes credentials, client data, internal hostnames, security procedures, or other non-public information in a public commit, issue, or document.
unreviewed-public-releaseUnreviewed Public Release
Material is published to a public repository or platform before information classification, export-control, or IP review is completed.
non-standard-crypto-publicationPublication of Non-Standard Cryptography
Software containing non-standard cryptography or authentication mechanisms is contributed without export-control review.
Identity and Infrastructure
Vectors involving contributor identity, attribution, and the infrastructure used to contribute.
company-identity-misuseCompany Identity Misuse
A contributor uses a company-associated identity for personal activity, continues using a company email after employment ends, or fails to use the required company external identity for company contributions.
company-infrastructure-misuseCompany Infrastructure Misuse
Personal contributions are made from company-owned hardware, company network, or company-managed tooling.
unapproved-tooling-useUse of Unapproved Tooling on Company Infrastructure
Contributions from company-managed hardware or the company network bypass OSPO-approved tools, scanning, or review workflows.
Legal Commitment
Vectors involving licenses, contributor agreements, and legal obligations created through participation.
unapproved-license-contributionContribution Under Unapproved License
A contributor participates in a project whose license is not approved in the OSPO license inventory or has changed without reassessment.
unreviewed-contributor-agreementAcceptance of Unreviewed Contributor Agreement
A contributor accepts a CLA, CCLA, DCO, or similar agreement creating legal obligations without required legal review.
perpetual-license-grant-without-approvalPerpetual License Grant Without Approval
Valuable company software is contributed under a FOSS license without sponsor or financial write-down approval.
Governance Process
Vectors involving bypass or failure of OSPO governance, approval, and lifecycle processes.
ungoverned-project-contributionUngoverned Project Contribution
Contribution proceeds without required OSPO registration, approval, or inventory association.
peer-review-bypassPeer Review Bypass
Contributions are merged or published without required peer review, maker-checker separation, or recorded approval history.
stale-engagement-neglectStale Engagement Neglect
FOSS engagements are not recertified, risk changes are not recorded, or retired projects retain active contribution entitlements.
Conduct and Engagement
Vectors involving public conduct, community engagement, and conflict of interest.
conflict-of-interest-participationConflict of Interest Participation
An employee participates in a project where external interests interfere with company obligations or appear to do so.
reputational-public-conductReputational Public Conduct
Public statements, code quality, project association, or community behavior reflect poorly on the company brand.