mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 17:29:45 +00:00

Arnas Donauskas bce345ed03

chore: OSS metadata + LICENSE + SECURITY + complete env example

Prep work so the repo is ready to be public. None of this is runtime
code; it's the governance a forker expects on day one.

- LICENSE: MIT at repo root. README already claimed MIT; this makes
  GitHub actually recognise it and show the license badge.

- .github/SECURITY.md: private disclosure path via GitHub Security
  Advisories or email. Spells out scope, safe harbour, and what the
  reporter should expect — so a researcher finds it before they try
  to file a public issue.

- .env.local.example: fleshed out with the three vars it was missing
  — META_APP_SECRET (required, from PR 1), NEXT_PUBLIC_SITE_URL
  (recommended), and AUTOMATION_CRON_SECRET (optional). Grouped as
  Required / Recommended / Optional with a one-line comment per
  entry. Includes the openssl/node generators for the secrets.

- package.json: description, repository, bugs, homepage, keywords,
  license, author, engines.node >=20. No runtime impact; feeds npm
  registry metadata, GitHub's repo sidebar, and prevents forkers from
  silently installing on Node <20 (Next 16's floor).

Typecheck clean; npm install run to refresh the lockfile for the
package.json metadata additions (no dependency changes).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 20:41:14 +03:00

2.3 KiB

Raw Blame History

Security Policy

Thanks for taking the time to look into WaCRM's security.

Reporting a vulnerability

Do not open a public GitHub issue for security bugs. Public issues are indexed by search engines and seen by every fork long before the upstream fix lands.

Instead, please report privately via one of:

GitHub Security Advisories (preferred — keeps the disclosure, fix, and CVE all in one place).
Email: a.donauskas@hostinger.com with [WaCRM security] in the subject.

Include, if you can:

A description of the issue and the impact.
Reproduction steps or a proof-of-concept.
The commit or release you're testing against.
Whether you'd like credit in the eventual disclosure (we default to crediting by the name or handle you give us, unless you prefer anonymous).

What to expect

Acknowledgement within 72 hours.
Initial assessment (severity, affected versions, whether a workaround exists) within one week.
Fix + coordinated disclosure on a timeline proportional to severity. Critical issues ship a patch as soon as one's ready; medium issues bundle with the next release.

Scope

In scope:

Anything in this repository (ArnasDon/wacrm), including webhook and auth flows, token encryption, RLS policies, and the built-in cron endpoints.
Default configurations shipped in docs/ — e.g. if the setup guide leaves an unsafe default.

Out of scope:

Vulnerabilities in Supabase, Next.js, Node.js, or other upstream dependencies — please report those to their maintainers. We'll happily bump versions on request.
Issues that require a pre-compromised deployment (e.g. a leaked service-role key) unless they widen the blast radius beyond the initial compromise.
Social engineering, physical attacks, or third-party services your fork adds after deploy.

Safe harbor

Research conducted under this policy is authorized. We won't pursue legal action against anyone who:

Makes a good-faith effort to avoid data destruction, privacy violations, or service disruption.
Gives us reasonable time to respond before any public disclosure.
Doesn't exploit the issue beyond what's necessary to demonstrate it.

Thanks for helping keep WaCRM (and its forks) safe.

2.3 KiB Raw Blame History