itflow-org · johnnyq · Sep 1, 2026 · Aug 12, 2026 · Aug 12, 2026 · Aug 13, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -146,6 +146,7 @@ ITFlow does not use prepared statements or an ORM; queries are built as strings.
 - **Integers** (IDs, flags, counts): `intval($_POST['ticket_id'])`. Interpolate unquoted.
 - **Strings**: `escapeSql($_POST['subject'])`. This normalizes encoding to UTF-8, then runs `strip_tags()`, `trim()`, and `mysqli_real_escape_string()`. Because it relies on SQL escaping, the value **must be placed inside quotes in the query** (`'$subject'`). An escaped string interpolated without quotes is still injectable.
 - **Values read back from the database** get the same treatment before reuse in another query (you will see `escapeSql($row['ticket_prefix'])` throughout — this is why).
+- **`logAudit()`, `appNotify()`, `logHistory()` and `logTicketHistory()` are queries too.** They interpolate their `$description` / `$details` / `$status` arguments straight into an `INSERT` — the SQL is just hidden inside the helper. A DB-read value passed into one of them (`logAudit("Asset", "Delete", "$asset_name ...", ...)`) must be `escapeSql`'d first, exactly as if you had written the `INSERT` by hand. This is easy to miss precisely because the call doesn't *look* like a query. Note that `escapeHtml()` is **not** a substitute here: it encodes `'` and `"` so it happens to block a quote-breakout, but it leaves backslashes untouched, so a value ending in `\` still escapes the closing quote. All four sinks now trim an odd trailing backslash as a backstop, but the value still owes `escapeSql` — the guard is defence-in-depth, not the fix.
 If you write a query and even one variable in it skipped these, that is a SQL injection. This is the single most common review rejection.
 
 **Fetch helpers return raw values — you escape them.** `getFieldById()` and `getTicketStatusName()` hand back exactly what is in the column. Escaping is the call site's job, the same as any other row you read:
@@ -291,6 +292,7 @@ Line endings and indentation are enforced by `.gitattributes` and `.editorconfig
 - CI runs PHP lint and db.sql lint; SonarCloud scans for security issues. Green checks are required but not sufficient — the conventions above are checked by human review.
 - Test your change against a real install: fresh setup from `db.sql` **and** an upgrade via `database_updates.php` if you touched schema.
 - For anything larger than a bug fix, **open an issue first** and discuss the approach. ITFlow's roadmap favors incremental modernization of the existing PHP codebase; large rewrites, framework introductions, and new runtime dependencies are out of scope.
+
 ## Getting help
- 
-Open a GitHub issue using the templates, or ask in the community forum linked from the README. When in doubt about a convention, find the closest existing example in the codebase and follow it — consistency beats novelty here.
+
+Ask in the community forum linked from the README. When in doubt about a convention, find the closest existing example in the codebase and follow it — consistency beats novelty here.
diff --git a/README.md b/README.md
@@ -27,7 +27,7 @@
     ·
     <a href="https://forum.itflow.org/t/bug">Report Bug</a>
     ·
-    <a href="https://forum.itflow.org/t/features">Request Feature</a>
+    <a href="https://forum.itflow.org/t/features">Suggest Feature</a>
     ·
     <a href="https://github.com/itflow-org/itflow/security/policy">Security</a>
   </p>
@@ -44,42 +44,42 @@
 ### The Problem
 - You're a small but busy managed service provider with 101 things to do. Information about your clients is unorganised, unstructured and outdated.
 - For some work, you seem to spend longer looking for the relevant documentation than actually working on the issue/project. 
-- On top of the technical day to day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting. 
+- MSP tools can be expensive, with recurring licensing costs adding up quickly.
+- On top of the technical day-to-day, you also have to take care of the financial side of the business - consistent pricing, quotes/invoicing, and accounting. 
 
 ### The Solution: ITFlow
-- ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified system.
+- ITFlow consolidates common MSP needs (documentation, ticketing and billing) into one unified, free platform that you control.
 
-<!-- GETTING STARTED -->
 ## Getting Started
 
 ### Self Hosting
-- The best installation method is to use the [install script](https://docs.itflow.org/installation_script) on Ubuntu/Debian. A video walk through is available [here](https://www.youtube.com/watch?v=kKz9NOU_1XE).
+- The best installation method is to use the [install script](https://docs.itflow.org/installation_script) on Ubuntu/Debian. See the [video](https://www.youtube.com/watch?v=kKz9NOU_1XE) walk through.
 ```
   wget -O itflow_install.sh https://github.com/itflow-org/itflow-install-script/raw/main/itflow_install.sh
   bash itflow_install.sh
 ```
 - Other manual installation methods are available in the [docs](https://docs.itflow.org/installation).
 
 ### Managed Hosting
-- If you'd prefer, we can [host ITFlow for you](https://services.itflow.org/hosting.php).
+- If you'd prefer, we can [host ITFlow for you](https://services.itflow.org/hosting.php) (coming soon).
 
 <!-- FEATURES -->
 ## Key Features
-* Client documentation - assets, contacts, domains, docs, files, passwords, and more 
-* Accounting / Billing - finance dashboard, quotes, invoices, accounting, expenses, etc
-* Client Portal - self service quote/invoice/ticket management for clients
-* Alerting - account balance, invoices, domain/SSL renewals
-* Completely free & open-source alternative to ITGlue and Hudu
+* Client documentation - assets, contacts, domains, docs/files, passwords, tickets, and more 
+* Billing - quotes, invoices and expenses, with Stripe integration for online payments
+* Alerting - domain and SSL expiry/renewals
+* Client Portal - self service quote, invoice, and ticket management for clients
+
 
 <!-- ROADMAP -->
 ## Roadmap / Future to-do
-We track the implementation of confirmed features and bugs via [TaskFlow](https://tasks.dev.itflow.org/tasks.php). Use the [forum](https://forum.itflow.org) to request features or raise bug reports. 
+We track the implementation of confirmed features and bugs via [TaskFlow](https://tasks.dev.itflow.org/tasks.php). Use the [forum](https://forum.itflow.org) to suggest new features or report bugs. 
 
 <!-- CONTRIBUTING -->
 ## Support & Contributions
 
 ### Forum
-For help using ITFlow, bugs, feature requests, and general ideas / discussions please use the community [forum](https://forum.itflow.org).
+For help using ITFlow, bugs, feature suggestions, and other general ideas or discussions, please use the community [forum](https://forum.itflow.org).
 
 ### Contributing
 We have temporarily paused PRs from the community.
@@ -90,17 +90,16 @@ We have temporarily paused PRs from the community.
 </a>
 
 ### Supporters
-We’re incredibly grateful to the organizations and individuals who support the project - a big thank you to:
+We’re incredibly grateful to the organizations and individuals who [sponsor](https://services.itflow.org) the project - a big thank you to:
 - CompuMatter
 - F1 for HELP
 - digiBandit
-- JetBrains (PhpStorm)
 
 ## License
 ITFlow is distributed "as is" under the GPL License, WITHOUT WARRANTY OF ANY KIND. See [`LICENSE`](https://github.com/itflow-org/itflow/blob/master/LICENSE) for details.
 
 ## Security
-* As of 2025, we now have a stable release of the project.
+* We've had a stable release of the project since Jan 2025.
 * Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
 * If you have a security concern, privately report it [here](https://github.com/itflow-org/itflow/security/policy).
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -1,24 +1,26 @@
 # Security Policy
 
-## **Please do NOT report security concerns/vulnerabilities publicly (Issues/forum)**
+## **Please do NOT report security concerns/vulnerabilities publicly**
 
-**We take security seriously**
+**ITFlow stores important information, so we take security seriously**
 
-- Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs. Use your best judgement before storing highly confidential information in ITFlow.
-- We attempt to follow security best practices where possible, including [automated code scanning](https://sonarcloud.io/component_measures?id=itflow-org_itflow&metric=security_rating&view=list).
-- [![Security](https://sonarcloud.io/api/project_badges/measure?project=itflow-org_itflow&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=itflow-org_itflow)
+- Whilst we are confident in the safety of the code, no system is risk-free. Nearly all software has bugs.
+- Use your best judgement before storing highly confidential information in ITFlow.
+- We attempt to follow security best practices where possible, including automated code scanning.
 
 ## Supported Versions
 We operate a rolling release model. Any bug fixes will be released into latest version of ITFlow, so you must stay up-to-date.
 
 | Version | Supported          |
 |---------| ------------------ |
-| 26.08   | :white_check_mark: |
+| 26.09   | :white_check_mark: |
 
 ## Reporting a Vulnerability via GitHub Security Advisories
 
 **Security contact: [GitHub Security Advisories](https://github.com/itflow-org/itflow/security/advisories/new)**
 
-If you have discovered a security issue, please **[report it](https://github.com/itflow-org/itflow/security/advisories/new)** to us in as much detail as possible, so we can fix it. 
+If you have discovered a security issue, please **[report it](https://github.com/itflow-org/itflow/security/advisories/new)** to us so we can fix it. 
 
-You should expect to receive an initial acknowledgement within 72 hours. If you don't receive any feedback, we may have missed the initial email from GitHub (we're human!). Please raise a forum discussion quoting ONLY the assigned GHSA ref.
+You should expect to receive an initial acknowledgement within 7 days. If you don't receive any feedback, we may have missed the initial email from GitHub (we're human!). Please raise a forum discussion quoting ONLY the assigned GHSA ref.
+
+Note: Please don't submit AI slop. AI can be useful for drafting and research, but you are responsible for reviewing and validating anything you submit. We reserve the right to restrict repository access if you repeatedly ignore this requirement.