> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Structural hazards (T)

- URL: /taxonomies/software-factory/structural-hazards/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:56:13.282Z
- Description: Structural hazards (T): 10 hazards in the software factory threat taxonomy, with mitigations. Hazards of the software factory as a whole.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Structural hazards

**The whole factory · 10 hazards · prefix T**

These ten hazards are properties of the software factory itself, so no single station can fix them. Apply them to the whole design after the stations.

**Scope:** Hazards of the software factory as a whole.

![Table: Structural hazards (T), 10 hazards with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/121/taxonomy-table-18-T.png =1400x3802)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The hazards

- <span id="t10"></span>**T10** Transitive Trust
- <span id="t9"></span>**T9** Names That Move
- <span id="t8"></span>**T8** The Pipeline Outranks Everyone
- <span id="t7"></span>**T7** Running Strangers' Code Is the Job
- <span id="t6"></span>**T6** The Guard Is Inside the Wall
- <span id="t5"></span>**T5** Checked Is Not Run
- <span id="t4"></span>**T4** Configuration Is Code
- <span id="t3"></span>**T3** Self-Propagation
- <span id="t2"></span>**T2** Shared Fate
- <span id="t1"></span>**T1** Evidence Lives Where the Attacker Works

## Seen in the wild

- **T10 Transitive Trust:** SolarWinds (2020).
- **T9 Names That Move:** trivy-action (2026).
- **T8 The Pipeline Outranks Everyone:** Codecov (2021).
- **T7 Running Strangers' Code Is the Job:** Shai-Hulud (2025).
- **T6 The Guard Is Inside the Wall:** Trivy and KICS (2026).
- **T3 Self-Propagation:** Shai-Hulud (2025).
- **T2 Shared Fate:** tj-actions (2025).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 10 entries here, STRIDE fits 5 cleanly and 5 only loosely. CAPEC 3.9 has a pattern that describes 1 of them directly, and only a generic parent pattern for 9. CWE 4.20 names the weakness directly for 2, has only a broader weakness for 7, and nothing for 1. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Structural hazards (T), 10 hazards, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/121/software-factory-mapping-table-18-T.png =1400x1774)

---

← [Delivery and Deployment (DL)](/taxonomies/software-factory/delivery-and-deployment/) · [Software factory overview](/taxonomies/software-factory/)

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*