mirror of
https://github.com/FOSSBilling/FOSSBilling.git
synced 2026-10-23 03:37:01 +09:00
Adam Daley
1420584f6d
* Add security-advisory-triage skill Codifies the two-stage workflow for handling a reported GitHub Security Advisory: verify it against current code with file:line evidence, then refine its title/description/CVSS/CWE metadata to match this repo's actual publish conventions before applying it. Includes a living house-style reference derived from this repo's own published advisories. Lives at .agents/skills/ with .claude/skills symlinked to it, matching the existing AGENTS.md/.claude/CLAUDE.md convention for cross-tool agent support. * Fix spellcheck: add GHSA/macrovector/rubygems, ignore skills reference dir The skills reference file legitimately contains GHSA advisory IDs as provenance examples; those are opaque identifiers, not real words, and new ones will keep appearing as more advisories get referenced there over time, so excluding the directory from spellcheck avoids repeated dictionary churn rather than fixing it once. * Address CodeRabbit review on security-advisory-triage skill - Stage 1's current-code check now requires an exact revision match (fetch + clean worktree + exact rev-parse comparison) instead of only an ancestor check, which could pass against a stale or divergent base. - Stage 1's related-history step now queries each advisory state explicitly with --method GET, and calls out that gh api silently sends a POST (hitting the advisory-creation endpoint) when -f is used without --method GET. Verified directly against this repo: an unfiltered call does return every state for a maintainer-authenticated token, but explicit per-state queries are more portable. - Confidentiality note broadened to cover chat/review/tool output, not just committed artifacts. - CVSS guidance now distinguishes the nested read path (cvss_severities.cvss_v3/cvss_v4) from the flat write field (cvss_vector_string), and notes severity/cvss_vector_string are mutually exclusive on write. - The live-advisory PATCH checklist now lists the actual top-level fields (summary, description, cwe_ids, cvss_vector_string/severity) instead of vaguely saying 'the description body', notes vulnerabilities is an array rather than assuming index [0] is everything, and says to PATCH the complete object per entry rather than a partial one. - Added language tags to two fenced code blocks (shell, markdown) per markdownlint MD040. * Fix data-loss gap in vulnerabilities PATCH guidance The 'send the complete object' instruction added last round listed only four fields (package.ecosystem/name, vulnerable_version_range, patched_versions) and omitted vulnerable_functions, which is a real field on the object (confirmed: this session's own successful PATCH sent it as an empty array). Following that guidance literally on an advisory where vulnerable_functions is actually populated would erase it. Added the missing field.
Note
FOSSBilling is under active development and currently considered beta. Expect rough edges and limited support.
FOSSBilling is a free, open-source billing and client management system. It helps online service businesses automate invoicing, payments, and client communication. While it’s popular with web hosting providers, it also works well for software licensing, digital downloads, and subscription services.
Features
- Billing & Invoicing: automated invoices, reminders, and basic reporting.
- Client Management: a central place for client data and communication.
- Extensibility: extension-friendly architecture for integrations and custom features.
- Payments: support for multiple gateways.
- Translations: community-powered, multi-language interface.
- Responsive UI: usable on desktop and mobile.
- Security-focused: built with security best practices in mind.
Getting Started
Requirements
FOSSBilling runs on standard LAMP/LEMP stacks. For the latest system requirements (PHP version, extensions, database, etc.), see the official requirements.
Installation
Follow the step-by-step Getting Started guide.
Just exploring? Try the public demo.
Contributing
We welcome contributions from the community! We’re actively modernizing the codebase and there’s plenty to do.
- Read the contributor guide.
- Pick an item from the open issues.
- Open a PR when you’re ready.
If you prefer to start a conversation first, drop by the forum or say hello on Discord.
Star History
Not a developer? Starring the repository helps others discover the project.
License
FOSSBilling is released under the Apache 2.0 license. See LICENSE for details.
Links
- Website: https://www.fossbilling.org/
- Documentation: https://docs.fossbilling.org/
- Discord: https://fossbilling.org/discord
- Twitter/X: https://twitter.com/FOSSBilling