mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
faee4eea44
Drops the "WaCRM" branded name across user-facing surfaces in favour
of a descriptive name. Branded names that imply WhatsApp ownership or
sponsorship are a trademark fair-use risk; a relationship-based name
("CRM Template for WhatsApp") sidesteps that.
Scope:
- Brand text in nav, sidebar, footer, docs shell, mock window chrome.
- SITE_NAME / SITE_DESCRIPTION / legalName in src/lib/seo/site-config.ts.
- README, CONTRIBUTING, docs/, .github/ templates and policies.
- package.json description.
- Auth pages, settings copy, FAQ, code comments.
Out of scope (intentionally — these are infra renames the project
owner should drive separately so links and the package lockfile stay
consistent):
- The github.com/ArnasDon/wacrm repo URL.
- The wacrm.tech domain / homepage field.
- The package.json "name" field.
- The Hostinger application name and Meta system-user name in deploy
docs (existing-deployment instructions).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
63 lines
2.3 KiB
Markdown
63 lines
2.3 KiB
Markdown
# Security Policy
|
|
|
|
Thanks for taking the time to look into the security of this template.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not open a public GitHub issue for security bugs.** Public issues are
|
|
indexed by search engines and seen by every fork long before the upstream fix
|
|
lands.
|
|
|
|
Instead, please report privately via one of:
|
|
|
|
- [GitHub Security Advisories](https://github.com/ArnasDon/wacrm/security/advisories/new)
|
|
(preferred — keeps the disclosure, fix, and CVE all in one place).
|
|
- Email: `a.donauskas@hostinger.com` with `[CRM template security]` in the subject.
|
|
|
|
Include, if you can:
|
|
|
|
- A description of the issue and the impact.
|
|
- Reproduction steps or a proof-of-concept.
|
|
- The commit or release you're testing against.
|
|
- Whether you'd like credit in the eventual disclosure (we default to
|
|
crediting by the name or handle you give us, unless you prefer anonymous).
|
|
|
|
## What to expect
|
|
|
|
- **Acknowledgement** within 72 hours.
|
|
- **Initial assessment** (severity, affected versions, whether a workaround
|
|
exists) within one week.
|
|
- **Fix + coordinated disclosure** on a timeline proportional to severity.
|
|
Critical issues ship a patch as soon as one's ready; medium issues bundle
|
|
with the next release.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
- Anything in this repository (`ArnasDon/wacrm`), including webhook and auth
|
|
flows, token encryption, RLS policies, and the built-in cron endpoints.
|
|
- Default configurations shipped in `docs/` — e.g. if the setup guide leaves
|
|
an unsafe default.
|
|
|
|
Out of scope:
|
|
- Vulnerabilities in Supabase, Next.js, Node.js, or other upstream
|
|
dependencies — please report those to their maintainers. We'll happily
|
|
bump versions on request.
|
|
- Issues that require a pre-compromised deployment (e.g. a leaked
|
|
service-role key) unless they widen the blast radius beyond the initial
|
|
compromise.
|
|
- Social engineering, physical attacks, or third-party services your fork
|
|
adds after deploy.
|
|
|
|
## Safe harbor
|
|
|
|
Research conducted under this policy is authorized. We won't pursue legal
|
|
action against anyone who:
|
|
|
|
- Makes a good-faith effort to avoid data destruction, privacy violations,
|
|
or service disruption.
|
|
- Gives us reasonable time to respond before any public disclosure.
|
|
- Doesn't exploit the issue beyond what's necessary to demonstrate it.
|
|
|
|
Thanks for helping keep this template (and its forks) safe.
|