TulioCP
Downloads Get started
Downloads Get started

About

Forked openly. Maintained independently.

TulioCP and TulioBilling are both forks of established open-source projects. That's not hidden in the fine print — it's the reason either product is trustworthy enough to run production infrastructure on. Here's exactly where each came from and what's changed.

Panel lineage

TulioCP

  1. VestaCP

    Original web hosting control panel project.

  2. HestiaCP

    GPL-3.0 fork of VestaCP, actively maintained by an independent community.

  3. TulioCP

    GPL-3.0 fork of HestiaCP. The name and logo are not covered by the GPL and don't imply endorsement by the upstream projects.

Billing lineage

TulioBilling

  1. BoxBilling

    Original Apache-2.0 billing and client-management project (2011–2021).

  2. FOSSBilling

    Apache-2.0 continuation of BoxBilling, maintained by an independent community.

  3. TulioBilling

    Apache-2.0 fork of FOSSBilling, in active development.

Ownership & roadmap

Independently owned, independently prioritized

TulioCP and TulioBilling are maintained independently of HestiaCP, VestaCP, FOSSBilling, and BoxBilling. Roadmap decisions — what gets rebuilt, rebranded, or repackaged next — are made by this project, not inherited from upstream. Both source repositories are currently private during the rebrand and packaging work; see /downloads for how to request installer and source access.

Security posture

How vulnerabilities are handled

  • Vulnerability reports are handled through private disclosure, not public issues
  • Priority areas: remote code execution, injection, authentication bypass, privilege escalation, XSS, CSRF
  • Only the latest release is supported with security fixes
  • Coordinated disclosure — reporters are asked not to go public before a fix ships

This process is inherited directly from the panel's GPL-3.0 lineage and applies unchanged under TulioCP.