# Plugin Developer FAQ

**Document Version:** 1.0.0
**Last Updated:** 2026-01-25

This FAQ addresses common questions from plugin developers working with the Stella Ops
Community Plugin Grant. For the full legal terms, see `LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md`
in the repository root.

---

## General Questions

### Q1: What constitutes a "Plugin" under the Community Plugin Grant?

**A:** A Plugin is a separately packaged extension that interfaces with Stella Ops using
documented public plugin APIs or integration points. This includes:

**Examples of Plugins:**
- Custom vulnerability connectors (e.g., integrating a proprietary vulnerability database)
- CI/CD integrations (e.g., Jenkins, GitLab CI, Azure DevOps plugins)
- Output formatters (e.g., custom report templates, dashboard integrations)
- Notification connectors (e.g., Slack, Teams, PagerDuty integrations)
- Scanner analyzers (e.g., language-specific dependency parsers)
- Policy gates (e.g., custom compliance rules)

**NOT Plugins (derivative works requiring BUSL-1.1 compliance):**
- Modifications to Stella Ops core source code
- Forks that include modified Stella Ops components
- Extensions that copy substantial portions of Stella Ops internals

### Q2: Can I sell my plugin commercially?

**A:** Yes. You may develop and sell plugins commercially under license terms of your
choosing (including proprietary terms), provided:

1. Your plugin does not include, copy, or modify Stella Ops source code; AND
2. You comply with the attribution requirements (see Q4).

Your commercial plugin license is entirely separate from the BUSL-1.1 license covering
Stella Ops itself.

### Q3: Do I need to open-source my plugin?

**A:** No. Plugins that interface with Stella Ops through public APIs do not need to be
open-sourced. You may use any license you choose, including proprietary licenses.

**Exception:** If your plugin includes, copies, or modifies any portion of Stella Ops
source code, it becomes a derivative work subject to BUSL-1.1.

### Q4: What attribution is required when distributing a plugin?

**A:** When distributing a plugin, you should:

1. **Acknowledge compatibility:** State that your plugin is designed for use with
   Stella Ops (e.g., "Compatible with Stella Ops Suite")

2. **Include license reference:** If your plugin distribution includes any Stella Ops
   components (even configuration samples), include the LICENSE and NOTICE files

3. **Link to source:** Provide a link to the Stella Ops source repository
   (https://git.stella-ops.org)

**Minimum attribution example:**
```
This plugin is designed for use with Stella Ops Suite.
Stella Ops is licensed under BUSL-1.1. See https://git.stella-ops.org
```

---

## Usage Limits

### Q5: What counts as an "Environment"?

**A:** An Environment is a logically separated workspace within a Stella Ops installation.
The free tier allows up to 3 Environments per installation.

**Each of these counts as one Environment:**
- A "Development" environment for testing scans
- A "Staging" environment for pre-production validation
- A "Production" environment for live deployments
- A tenant/workspace in a multi-tenant setup
- A project or team workspace with isolated configuration

**These do NOT count as separate Environments:**
- High-availability replicas of the same environment
- Read replicas or cache nodes
- Backup/disaster recovery instances (if not actively used)

**Example scenarios:**

| Scenario | Environment Count |
|----------|------------------|
| Single dev laptop installation | 1 |
| Dev + Staging + Prod for one team | 3 |
| Two separate teams, each with Dev + Prod | 4 (requires commercial license) |
| MSP hosting 5 isolated customer instances | 5 (requires commercial license) |

### Q6: What counts as a "Scan"?

**A:** A Scan is one completed execution of Stella Ops' vulnerability or artifact analysis
pipeline that produces a new result. The free tier allows up to 999 Scans per calendar day.

**Counts as a Scan:**
- First-time scan of a container image (new hash)
- Re-scan of a modified image (hash changed)
- SBOM generation for a new artifact
- VEX statement generation for new findings

**Does NOT count as a Scan:**
- Cache hits (retrieving previously scanned results)
- Viewing existing scan reports
- Policy evaluation on cached data
- API queries for existing results

**Deduplication:** Stella Ops uses hash-based deduplication. Scanning the same artifact
multiple times only counts as one Scan if the hash hasn't changed.

### Q7: What happens if my users exceed the free limits?

**A:** If users of your plugin exceed the free tier limits (3 Environments or 999 Scans/day):

1. **They need a commercial license** - The user (not the plugin developer) is responsible
   for licensing compliance
2. **Your plugin continues to work** - There's no technical enforcement in the plugin itself
3. **Quota enforcement is server-side** - Stella Ops may introduce delays after limits
   are exceeded (see `docs/legal/30_QUOTA_ENFORCEMENT_FLOW1.md`)

As a plugin developer, you should:
- Document the free tier limits in your plugin documentation
- Recommend users contact stella-ops.org for commercial licensing if they exceed limits
- Not build quota circumvention into your plugin

---

## Bundling & Distribution

### Q8: Can I bundle Stella Ops core with my plugin?

**A:** This depends on how you bundle:

**Allowed (aggregation):**
- Shipping your plugin alongside Stella Ops as separate components
- Docker Compose files that reference Stella Ops images
- Helm charts that deploy Stella Ops as a dependency
- Installation scripts that download Stella Ops separately

**Requires BUSL-1.1 compliance (derivative work):**
- Embedding Stella Ops source code into your plugin
- Modifying Stella Ops binaries and redistributing
- Creating a single binary that includes Stella Ops components

**Requires commercial license:**
- Bundling into a competing managed service offering
- White-labeling Stella Ops functionality

### Q9: Can I create a plugin that modifies Stella Ops behavior at runtime?

**A:** Yes, if the modification uses documented extension points:

**Allowed:**
- Plugins that register custom handlers via plugin APIs
- Extensions that add new endpoints or processing steps
- Integrations that intercept and transform data via documented hooks

**Not allowed without BUSL-1.1 derivative work compliance:**
- Runtime patching of Stella Ops binaries
- Monkey-patching internal classes or methods
- Replacing core components at runtime

The key distinction is whether you're using **documented public APIs** (allowed) vs.
**undocumented internal behavior** (derivative work).

---

## Commercial Considerations

### Q10: Can my plugin be used with Stella Ops commercial/SaaS offerings?

**A:** Yes. Plugins designed for the Community Plugin Grant are compatible with commercial
Stella Ops deployments. Commercial customers may use community plugins subject to their
commercial license terms.

### Q11: Do I need Licensor approval to publish a plugin?

**A:** No. You do not need approval from stella-ops.org to:
- Develop plugins
- Publish plugins (open source or commercial)
- List plugins in third-party marketplaces

However, stella-ops.org may maintain an official plugin registry with quality/security
standards for listed plugins.

### Q12: Can MSPs provide plugins to their managed customers?

**A:** Yes, with these considerations:

1. **Plugin distribution:** MSPs can freely distribute plugins to customers
2. **Stella Ops licensing:** Each customer deployment must comply with BUSL-1.1:
   - Within free tier limits; OR
   - Covered by MSP's commercial license; OR
   - Customer has their own commercial license

See `docs/legal/SAAS_MSP_GUIDANCE.md` for detailed MSP scenarios.

---

## Edge Cases

### Q13: Does the Community Plugin Grant apply to unofficial API integrations?

**A:** The grant specifically covers plugins using "documented public plugin APIs or
integration points." For unofficial or undocumented APIs:

- Using undocumented APIs is at your own risk (they may change without notice)
- The Community Plugin Grant still applies if you're not modifying source code
- Relying on internal implementation details may create a derivative work

**Recommendation:** Use documented APIs for stable, supported integration.

### Q14: Can I fork Stella Ops and call it something else?

**A:** Forking is allowed under BUSL-1.1, but:

1. **BUSL-1.1 applies to the fork** - Production use requires compliance with the
   Additional Use Grant or a commercial license
2. **Attribution required** - You must preserve LICENSE, NOTICE, and copyright notices
3. **No trademark use** - You may not use Stella Ops trademarks for your fork
4. **Change Date applies** - After the Change Date (2030-01-20), the fork converts to
   Apache-2.0

### Q15: What if my plugin becomes popular and used beyond free tier limits?

**A:** Success is good! If your plugin enables usage beyond free tier limits:

1. **Users are responsible for licensing** - Not you as the plugin developer
2. **Consider partnership** - Contact stella-ops.org about potential partnership or
   revenue sharing arrangements
3. **Document clearly** - Ensure your plugin documentation explains licensing requirements

### Q16: Can I host a free scanning service for the community using my plugin?

**A:** The BUSL-1.1 restriction specifically targets "public multi-tenant **paid** hosting."
Non-commercial, free-of-charge hosting for community benefit may be eligible for the
Community Program.

**Potentially eligible:**
- Free scanning for open source projects
- Academic/educational free access
- Non-profit services for other non-profits

**Not eligible (requires commercial license):**
- "Free tier" that upsells to paid services
- Free scanning bundled with paid consulting
- Any scenario where the free service drives commercial revenue

**Process:** Apply to the Community Program at community@stella-ops.org. Approval is
not automatic and is evaluated based on genuine community benefit.

See `docs/legal/SAAS_MSP_GUIDANCE.md` Section 4.3 for detailed guidance.

---

## Getting Help

**Technical questions about plugin development:**
- Documentation: `docs/plugins/`
- Community forum: https://community.stella-ops.org

**Licensing questions:**
- Email: legal@stella-ops.org
- FAQ: This document and `docs/legal/LEGAL_FAQ_QUOTA.md`

**Commercial licensing:**
- Email: sales@stella-ops.org
- Website: https://stella-ops.org/pricing

---

## See Also

- `LICENSE-ADDENDUM-COMMUNITY-PLUGIN-GRANT.md` - Full legal terms
- `docs/legal/LEGAL_FAQ_QUOTA.md` - Quota and free tier FAQ
- `docs/legal/SAAS_MSP_GUIDANCE.md` - MSP and SaaS guidance
- `docs/legal/LICENSE-COMPATIBILITY.md` - License compatibility for dependencies

---

*Document maintained by: Legal + Developer Relations*
*Last review: 2026-01-25*