mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 09:19:51 +00:00
chore: OSS metadata + LICENSE + SECURITY + complete env example
Prep work so the repo is ready to be public. None of this is runtime code; it's the governance a forker expects on day one. - LICENSE: MIT at repo root. README already claimed MIT; this makes GitHub actually recognise it and show the license badge. - .github/SECURITY.md: private disclosure path via GitHub Security Advisories or email. Spells out scope, safe harbour, and what the reporter should expect — so a researcher finds it before they try to file a public issue. - .env.local.example: fleshed out with the three vars it was missing — META_APP_SECRET (required, from PR 1), NEXT_PUBLIC_SITE_URL (recommended), and AUTOMATION_CRON_SECRET (optional). Grouped as Required / Recommended / Optional with a one-line comment per entry. Includes the openssl/node generators for the secrets. - package.json: description, repository, bugs, homepage, keywords, license, author, engines.node >=20. No runtime impact; feeds npm registry metadata, GitHub's repo sidebar, and prevents forkers from silently installing on Node <20 (Next 16's floor). Typecheck clean; npm install run to refresh the lockfile for the package.json metadata additions (no dependency changes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Arnas Donauskas
parent
d6a4677e6c
commit
bce345ed03
@ -1,16 +1,44 @@
|
||||
# Supabase
|
||||
# ============================================================
|
||||
# REQUIRED — the app won't start without these.
|
||||
# ============================================================
|
||||
|
||||
# Supabase (Project Settings → API)
|
||||
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
||||
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
||||
|
||||
# Supabase Service Role (for server-side operations like webhook handling)
|
||||
# Supabase service-role key. Bypasses RLS; used only by server-side
|
||||
# routes (the webhook and automation engine). Keep this secret —
|
||||
# never paste it into client code.
|
||||
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
||||
|
||||
# WhatsApp Token Encryption (64 hex chars = 32 bytes for AES-256-CBC)
|
||||
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
||||
# WhatsApp token encryption (64 hex chars = 32 bytes, AES-256-GCM).
|
||||
# Generate with:
|
||||
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
||||
# Rotating this value orphans every token encrypted under the previous
|
||||
# key — users have to re-save their WhatsApp settings to reconnect.
|
||||
ENCRYPTION_KEY=your-64-char-hex-key-here
|
||||
|
||||
# Meta App Secret — REQUIRED. Used to verify the HMAC-SHA256 signature
|
||||
# Meta attaches to inbound webhook POSTs. Without it, the webhook
|
||||
# rejects every request. Find it at:
|
||||
# Meta for Developers → your app → App Settings → Basic → App Secret
|
||||
# Meta App Secret (Meta for Developers → App Settings → Basic).
|
||||
# Verifies the HMAC-SHA256 signature on every inbound webhook POST.
|
||||
# Required — without it the webhook rejects every request.
|
||||
META_APP_SECRET=your-meta-app-secret
|
||||
|
||||
# ============================================================
|
||||
# RECOMMENDED — safe defaults exist but you'll want to set these.
|
||||
# ============================================================
|
||||
|
||||
# Canonical public URL of this deployment (scheme + host, no trailing
|
||||
# slash). Used for the sitemap, OG images, and any email the app
|
||||
# sends. Defaults to https://wacrm.tech if unset.
|
||||
NEXT_PUBLIC_SITE_URL=https://crm.example.com
|
||||
|
||||
# ============================================================
|
||||
# OPTIONAL — only needed if you use the feature.
|
||||
# ============================================================
|
||||
|
||||
# Shared secret protecting GET /api/automations/cron. Required if you
|
||||
# use Wait steps in automations (a scheduled pinger drains pending
|
||||
# executions). Generate any long random string:
|
||||
# openssl rand -hex 32
|
||||
# See docs/automations-and-cron.md.
|
||||
# AUTOMATION_CRON_SECRET=generate-a-long-random-string
|
||||
|
||||
62
.github/SECURITY.md
vendored
Normal file
62
.github/SECURITY.md
vendored
Normal file
@ -0,0 +1,62 @@
|
||||
# Security Policy
|
||||
|
||||
Thanks for taking the time to look into WaCRM's security.
|
||||
|
||||
## Reporting a vulnerability
|
||||
|
||||
**Do not open a public GitHub issue for security bugs.** Public issues are
|
||||
indexed by search engines and seen by every fork long before the upstream fix
|
||||
lands.
|
||||
|
||||
Instead, please report privately via one of:
|
||||
|
||||
- [GitHub Security Advisories](https://github.com/ArnasDon/wacrm/security/advisories/new)
|
||||
(preferred — keeps the disclosure, fix, and CVE all in one place).
|
||||
- Email: `a.donauskas@hostinger.com` with `[WaCRM security]` in the subject.
|
||||
|
||||
Include, if you can:
|
||||
|
||||
- A description of the issue and the impact.
|
||||
- Reproduction steps or a proof-of-concept.
|
||||
- The commit or release you're testing against.
|
||||
- Whether you'd like credit in the eventual disclosure (we default to
|
||||
crediting by the name or handle you give us, unless you prefer anonymous).
|
||||
|
||||
## What to expect
|
||||
|
||||
- **Acknowledgement** within 72 hours.
|
||||
- **Initial assessment** (severity, affected versions, whether a workaround
|
||||
exists) within one week.
|
||||
- **Fix + coordinated disclosure** on a timeline proportional to severity.
|
||||
Critical issues ship a patch as soon as one's ready; medium issues bundle
|
||||
with the next release.
|
||||
|
||||
## Scope
|
||||
|
||||
In scope:
|
||||
- Anything in this repository (`ArnasDon/wacrm`), including webhook and auth
|
||||
flows, token encryption, RLS policies, and the built-in cron endpoints.
|
||||
- Default configurations shipped in `docs/` — e.g. if the setup guide leaves
|
||||
an unsafe default.
|
||||
|
||||
Out of scope:
|
||||
- Vulnerabilities in Supabase, Next.js, Node.js, or other upstream
|
||||
dependencies — please report those to their maintainers. We'll happily
|
||||
bump versions on request.
|
||||
- Issues that require a pre-compromised deployment (e.g. a leaked
|
||||
service-role key) unless they widen the blast radius beyond the initial
|
||||
compromise.
|
||||
- Social engineering, physical attacks, or third-party services your fork
|
||||
adds after deploy.
|
||||
|
||||
## Safe harbor
|
||||
|
||||
Research conducted under this policy is authorized. We won't pursue legal
|
||||
action against anyone who:
|
||||
|
||||
- Makes a good-faith effort to avoid data destruction, privacy violations,
|
||||
or service disruption.
|
||||
- Gives us reasonable time to respond before any public disclosure.
|
||||
- Doesn't exploit the issue beyond what's necessary to demonstrate it.
|
||||
|
||||
Thanks for helping keep WaCRM (and its forks) safe.
|
||||
21
LICENSE
Normal file
21
LICENSE
Normal file
@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2026 Arnas Donauskas
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
4
package-lock.json
generated
4
package-lock.json
generated
@ -7,6 +7,7 @@
|
||||
"": {
|
||||
"name": "wacrm",
|
||||
"version": "0.1.0",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@base-ui/react": "^1.4.0",
|
||||
"@dnd-kit/core": "^6.3.1",
|
||||
@ -36,6 +37,9 @@
|
||||
"eslint-config-next": "16.2.4",
|
||||
"tailwindcss": "^4",
|
||||
"typescript": "^5"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=20.0.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@alloc/quick-lru": {
|
||||
|
||||
25
package.json
25
package.json
@ -2,6 +2,31 @@
|
||||
"name": "wacrm",
|
||||
"version": "0.1.0",
|
||||
"private": true,
|
||||
"description": "Self-hostable WhatsApp CRM built on Next.js and Supabase — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations.",
|
||||
"license": "MIT",
|
||||
"author": "Arnas Donauskas",
|
||||
"homepage": "https://wacrm.tech",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git+https://github.com/ArnasDon/wacrm.git"
|
||||
},
|
||||
"bugs": {
|
||||
"url": "https://github.com/ArnasDon/wacrm/issues"
|
||||
},
|
||||
"keywords": [
|
||||
"crm",
|
||||
"whatsapp",
|
||||
"whatsapp-business-api",
|
||||
"nextjs",
|
||||
"supabase",
|
||||
"automation",
|
||||
"broadcast",
|
||||
"self-hosted",
|
||||
"template"
|
||||
],
|
||||
"engines": {
|
||||
"node": ">=20.0.0"
|
||||
},
|
||||
"scripts": {
|
||||
"dev": "next dev",
|
||||
"build": "next build",
|
||||
|
||||
Loading…
Reference in New Issue
Block a user