Skip to content
From 1 January 2027, German businesses above €800,000 turnover must issue e-invoices. Get your PHP or Laravel app ready

Security

Invoicing software handles sensitive data. We take reports seriously and respond quickly.

Supported versions

Security fixes are released for the latest minor version (currently 0.7.x) of quittio/quittio, quittio/core, quittio/laravel and the country packs quittio/country-de, -at, -be, -ch and -fr (those for Austria, Belgium, Switzerland and France not yet reviewed by a tax adviser).

Report a vulnerability

Please do not open a public issue. Report vulnerabilities privately through GitHub: Report a vulnerability. Include the affected version, steps to reproduce and, if possible, a sample invoice or input file.

What Quittio protects

  • Readers protected against XXE, entity expansion, zip bombs and oversized input
  • Checksums for downloaded validators and rules
  • Quittio Managed: immutable invoices, write-once archive with SHA-256, audit log