Bitcoin is open-source and relies on decentralization to achieve trustless consensus for transactions.

Ultimately, however, maintaining the Bitcoin Core code and deciding the direction of development has in practice been influenced primarily by a small (but growing) group of individuals. Scroll to the bottom of this page - https://bitcoin.org/en/development - for a list of contributors. Blockstream is also an authority on how Bitcoin development progresses, and many from their team - https://blockstream.com/team/ - are among that list of contributors. The current 'Core vs. Unlimited' debate illustrates how, if other Bitcoin participants believe Core development is not addressing concerns adequately and/or is under control of bad actors* they can present alternative code, which miners may freely choose instead. With enough of the network's hashrate this would cause a 'fork'.

Mining power can be centralized too, and is to some extent today, which leaves the network vulnerable to bad actors in what is commonly called a 51% attack (for close calls of the past and a larger discussion: http://www.coindesk.com/51-attacks-real-threat-bitcoin/).

These vulnerabilities are well-known and have been discussed for years without a perfect solution. With appropriate checks, balances, and participation from the community we mitigate the risks of development or mining truly becoming managed by a central authority; but with economic incentives present for certain actions, Bitcoin may always fall somewhere between decentralized and centralized. There is strong consensus in the community that this is still better than our traditional alternatives.

*not to imply either as fact in that debate; just for a relevant framework