> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Version Control (VC)

- URL: /taxonomies/software-factory/version-control/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T13:04:32.083Z
- Description: Version Control (VC): 13 threats in the software factory threat taxonomy. Repositories, branches, tags, review, forks, the hosting platform, its apps and bots.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Version Control

**Station 02 of 17 · Line 1, Source to Artifact · 13 threats · prefix VC**

The repository is the system of record for intent: every later control assumes that what is in it is what its owners meant. These cards cover repositories, branches, tags, review, identities and the hosting platform itself.

**Scope:** Repositories, branches, tags, review, forks, the hosting platform, its apps and bots.

![Table: Version Control (VC), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/105/taxonomy-table-02-VC.png =1400x4724)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="vc-a"></span>**VC·A** Protected Branch Bypass
- <span id="vc-k"></span>**VC·K** Mutable Tags and Refs
- <span id="vc-q"></span>**VC·Q** Platform Account Takeover
- <span id="vc-j"></span>**VC·J** Over-Privileged Apps and Tokens
- <span id="vc-10"></span>**VC·10** Malicious Maintainer
- <span id="vc-9"></span>**VC·9** Review Subversion
- <span id="vc-8"></span>**VC·8** Commit Identity Spoofing
- <span id="vc-7"></span>**VC·7** Repojacking
- <span id="vc-6"></span>**VC·6** Secrets in History
- <span id="vc-5"></span>**VC·5** Visibility Leak
- <span id="vc-4"></span>**VC·4** Hosting Platform Vulnerability
- <span id="vc-3"></span>**VC·3** Audit Gap
- <span id="vc-2"></span>**VC·2** Webhook Exposure

## Seen in the wild

- **VC·A Protected Branch Bypass:** Required reviews bypass via GitHub Actions (Cider, 2021).
- **VC·K Mutable Tags and Refs:** tj-actions/changed-files (2025); trivy-action (2026).
- **VC·Q Platform Account Takeover:** Gentoo GitHub organisation (2018).
- **VC·J Over-Privileged Apps and Tokens:** Stolen Heroku and Travis CI OAuth tokens (2022).
- **VC·10 Malicious Maintainer:** xz Utils, CVE-2024-3094 (2024).
- **VC·9 Review Subversion:** Trojan Source, CVE-2021-42574 (2021); xz Utils test files (2024).
- **VC·7 Repojacking:** Repojacking research (2020 onward).
- **VC·5 Visibility Leak:** Cross Fork Object Reference (Truffle Security, 2024).
- **VC·4 Hosting Platform Vulnerability:** Bitbucket Server CVE-2022-36804 (2022).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 11 cleanly and 2 only loosely. CAPEC 3.9 has a pattern that describes 5 of them directly, and only a generic parent pattern for 8. CWE 4.20 names the weakness directly for 8, has only a broader weakness for 5,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Version Control (VC), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/105/software-factory-mapping-table-02-VC.png =1400x2369)

---

← [Workstation and Agents (WS)](/taxonomies/software-factory/workstation-and-agents/) · [Software factory overview](/taxonomies/software-factory/) · [Pipeline Definition (PD)](/taxonomies/software-factory/pipeline-definition/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*