---
title: "Security · Quittio"
description: "Report security issues in Quittio privately: supported versions and reporting process."
canonical_url: "https://quittio.dev/en/security"
locale: en
meta:
  "og:description": "Report security issues in Quittio privately: supported versions and reporting process."
  "og:image": "https://quittio.dev/og/quittio-en.jpg"
  "og:image:alt": "Quittio: Invoices, settled. E-invoicing for PHP and Laravel, with a validated sample invoice."
  "og:image:height": "630"
  "og:image:type": image/jpeg
  "og:image:width": "1200"
  "og:title": "Security · Quittio"
  "twitter:image": "https://quittio.dev/og/quittio-en.jpg"
  "twitter:image:alt": "Quittio: Invoices, settled. E-invoicing for PHP and Laravel, with a validated sample invoice."
---

> Index of every page on this site: [llms.txt](https://quittio.dev/llms.txt)

# Security

Invoicing software handles sensitive data. We take reports seriously and respond quickly.

## Supported versions

Security fixes are released for the latest minor version (currently 0.3.x) of quittio/quittio, quittio/core, quittio/laravel and quittio/country-de.

## Report a vulnerability

Please do not open a public issue. Report vulnerabilities privately through GitHub: [Report a vulnerability](https://github.com/Quittio/quittio/security/advisories/new). Include the affected version, steps to reproduce and, if possible, a sample invoice or input file.

## What Quittio protects

- Readers protected against XXE, entity expansion, zip bombs and oversized input
- Checksums for downloaded validators and rules
- Quittio Managed: immutable invoices, write-once archive with SHA-256, audit log

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://quittio.dev/en#website","@type":"WebSite","description":"E-invoicing for PHP and Laravel: create, validate, read and archive ZUGFeRD, XRechnung and Peppol invoices.","inLanguage":"en","name":"Quittio","url":"https://quittio.dev/en","publisher":{"@id":"https://quittio.dev/#identity"},"translationOfWork":{"@id":"https://quittio.dev/#website"}},{"@id":"https://quittio.dev/en/security#webpage","@type":"WebPage","description":"Report security issues in Quittio privately: supported versions and reporting process.","name":"Security","url":"https://quittio.dev/en/security","breadcrumb":{"@id":"https://quittio.dev/en/security#breadcrumb"},"isPartOf":{"@id":"https://quittio.dev/en#website"},"potentialAction":[{"@type":"ReadAction","target":["https://quittio.dev/en/security"]}],"primaryImageOfPage":{"@id":"https://quittio.dev/#logo"}},{"@id":"https://quittio.dev/#identity","@type":"Organization","description":"Open-Source-Bibliothek für E-Rechnungen in PHP und Laravel (ZUGFeRD, XRechnung, Peppol) und Quittio Managed.","email":"kontakt@niklasforst.de","legalName":"Niklas Forst – Softwareentwicklung","name":"Quittio","url":"https://quittio.dev","founder":{"@type":"Person","name":"Niklas Forst","url":"https://quittio.dev/ueber"},"logo":{"@id":"https://quittio.dev/#logo"},"sameAs":["https://github.com/Quittio/quittio","https://packagist.org/packages/quittio/quittio"]},{"@id":"https://quittio.dev/en/security#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://quittio.dev/en","position":1},{"@type":"ListItem","name":"Security","position":2}]},{"@id":"https://quittio.dev/#logo","@type":"ImageObject","caption":"Quittio","contentUrl":"https://quittio.dev/logo.png","inLanguage":"en","url":"https://quittio.dev/logo.png"}]}
```