Bitcoin is a free protocol and Bitcoin Core, the reference implementation of the Bitcoin protocol, is open source software.
The Bitcoin Core R&D lab is a Github repository administered by a lead developer (currently Wladimir J. Van Der Laan) who can merge the various proposals into the main code.
However, his role does not constitute a point of vulnerability because if this Github repository falls into the wrong hands or if this main developer merges lines of code that have not been approved by the consensus of other renowned developers in the community, it will be disavowed and anyone can propose another deposit. Similarly, anyone can contribute, even anonymously, to improving the code.
Moreover, developer consensus is not enough. As renowned as they are, the developers working around the Bitcoin protocol have no decision-making power, they are only a force of proposal. When a new version is proposed (usually after long discussions, many proofreadings and many tests), the code is proposed to the nodes of the network which are free to adopt it or not.
Barring exceptions (and with the consensus of the community), the proposed code is always backwards compatible, which means that the transaction blocks produced by mining nodes updated with a new version are recognized as valid by the old nodes. that have not accepted the update (the reverse is not necessarily true, which encourages nodes to update).
