7.7 KiB
Additional Community Plugin Grant - StellaOps Addendum to BUSL-1.1
Addendum Version: 1.0.0 Effective Date: 2026-01-25 Licensor: stella-ops.org
This Addendum supplements the Business Source License 1.1 (BUSL-1.1) under which Stella Ops Suite is licensed. Where this Addendum conflicts with BUSL-1.1, this Addendum controls for the specific grants below.
1. Definitions
For purposes of this Addendum:
(a) "Plugin" means a separately packaged extension written to interface with the Licensed Work using documented public plugin APIs or integration points published by Licensor. A Plugin may include connectors, integrations, analyzers, formatters, or other extensions that extend the Licensed Work's functionality without modifying its core source code.
(b) "Environment" means an instance of the Licensed Work under the control of a single legal entity (customer/organization) and deployed to a unique production orchestration boundary. Examples include: a distinct on-premises cluster, a private cloud tenant, or a named cloud account. For avoidance of doubt, dev/staging/production deployments for the same organization each count as separate Environments.
(c) "Scan" means one completed execution of the Licensed Work's vulnerability or artifact analysis pipeline that produces a report or SBOM/VEX output and is billed or metered as a single unit by Licensor's published metrics. Cached or deduplicated results that do not trigger new analysis do not count as additional Scans.
2. Community Plugin Grant
Notwithstanding anything to the contrary in BUSL-1.1, Licensor hereby grants each Recipient a worldwide, non-exclusive, royalty-free license to:
(i) Use, run, and reproduce a Plugin in production solely for the Recipient's internal business operations in up to three (3) Environments; and
(ii) Perform up to nine hundred ninety-nine (999) Scans per calendar day across all such Environments.
This grant extends to modification and redistribution of the Plugin under the same terms, provided redistribution is not packaged with a commercial managed hosting offering in breach of Section 4 below.
Commercial Plugin Development. You may develop and sell Plugins commercially under license terms of your choosing, provided:
- The Plugin does not include, copy, or modify the Licensed Work's source code; AND
- Distribution complies with Section 3 below.
3. Distribution & Attribution
Recipients may distribute Plugin source or binaries under the same license terms as the Licensed Work (including this Addendum). Distributed copies must:
(a) Retain conspicuous attribution to Licensor, including the Licensor name and a link to the Licensed Work's source repository;
(b) Include this Addendum verbatim alongside any distribution of the Licensed Work or Plugins that incorporate portions of the Licensed Work;
(c) Preserve the LICENSE and NOTICE files from the original distribution.
Competing Service Restriction. Redistribution that embeds or repackages Licensor's core runtime binaries into a commercial product that functions as a competing managed service requires a separate commercial license from Licensor.
4. SaaS / Managed Offering Restriction
Recipients are NOT permitted to offer the Licensed Work or a Plugin (or a service that substantially replicates the Licensed Work's core features) as a commercial hosted service, SaaS, or managed/white-label hosting offering to third parties without a separate written commercial license from Licensor.
This restriction applies whether the service is offered:
- Directly to end customers;
- Via a reseller or channel partner; or
- Embedded into a larger multi-tenant managed platform.
Limited Exceptions:
(a) Internal Hosting. An organization may host the Licensed Work internally for its own employees, contractors, and affiliates without a commercial license, subject to the Environment and Scan limits in Section 2.
(b) MSP Single-Tenant Hosting. A Managed Service Provider (MSP) may host distinct single-tenant instances per customer only if: - Each hosted instance is covered by the MSP's commercial license; OR - The hosted instance remains fully isolated and used exclusively by the licensee's employees and affiliates.
(c) Public multi-tenant paid hosting that provides the Licensed Work's functionality to unrelated third parties is prohibited under this Addendum absent a commercial license.
(d) Non-Commercial Community Hosting. Non-commercial, free-of-charge hosting for community benefit (e.g., providing scanning services to open source projects) may be permitted under a separate community program. Organizations wishing to provide such services should contact Licensor at community@stella-ops.org for evaluation. Approval is not automatic and is subject to Licensor's community program terms.
For detailed guidance on MSP and SaaS scenarios, see docs/legal/SAAS_MSP_GUIDANCE.md.
5. Enforcement & Telemetry
Licensor may reasonably audit or require self-reporting to verify compliance with the Environment and Scan limits described in this Addendum.
Audit Rights. Licensor reserves the right to request compliance verification no more than once per calendar year, with reasonable notice (minimum 30 days). Any audit shall be:
- Conducted during normal business hours;
- Subject to standard confidentiality and data-protection safeguards; and
- Limited in scope to verification of Environment count and Scan volume.
Voluntary Telemetry. Licensor may provide an optional, privacy-respecting metering endpoint for voluntary telemetry. Such telemetry:
- Is strictly opt-in;
- Collects only aggregate usage metrics (Environment count, Scan count);
- Does not collect customer content, source code, or scan results; and
- Is subject to Licensor's published privacy policy.
Self-Attestation. Recipients may provide annual self-attestation of compliance
using the form at docs/legal/templates/self-attestation-form.md.
6. Term & Upgrade
This Addendum applies to releases of the Licensed Work that include it. Licensor may amend the numeric limits (Environments / Scans) by publishing a new Addendum version.
Non-Retroactive Changes. Such changes do not retroactively affect prior distributions. Recipients using a version of the Licensed Work with an earlier Addendum version may continue under those terms for that version.
Version Identification. Each Addendum version is identified by the version number in the header. The applicable Addendum version for any distribution is the version included with that distribution.
7. No Waiver of Other BUSL Rights
Except as explicitly modified by this Addendum, all terms of BUSL-1.1 remain in full force and effect, including but not limited to:
- The Change Date and Change License provisions;
- The requirement to preserve license and attribution notices;
- The disclaimer of warranties and limitation of liability.
8. Legal & Compliance Notice
This Addendum is intended as a narrow community grant to encourage plugin ecosystems while protecting Licensor's commercial SaaS market. It is not legal advice and should be reviewed by counsel prior to publication or reliance.
Governing Law. This Addendum is governed by the same jurisdiction and governing law provisions as the underlying BUSL-1.1 license.
Severability. If any provision of this Addendum is held unenforceable, the remaining provisions continue in full force and effect.
Change Log
| Version | Date | Notes |
|---|---|---|
| 1.0.0 | 2026-01-25 | Initial release of Community Plugin Grant Addendum. |
Document maintained by: Legal + Security Guild For questions: legal@stella-ops.org