LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
130 Commits 1 Branch 0 Tags 4.6 MiB
TypeScript 93.9%
PLpgSQL 5.6%
CSS 0.3%
f199b7a7ed
Go to file
Arnas Donauskas f199b7a7ed
security: baseline response headers (CSP report-only + OWASP set) 
Adds a catch-all rule in next.config.ts that merges a set of baseline
security headers into every response — served alongside the existing
Cache-Control rules, not instead of them.

Enforced today:
  - Strict-Transport-Security: 2yr, includeSubDomains, preload-eligible.
    No-op on http://localhost.
  - X-Content-Type-Options: nosniff
  - X-Frame-Options: DENY  (same defense as frame-ancestors below, but
    older browsers only read this one)
  - Referrer-Policy: strict-origin-when-cross-origin
  - Permissions-Policy: deny camera/mic/geolocation/payment/usb. We
    don't use any of those APIs; closing them off prevents a supply-
    chain compromise or a forgotten plugin from silently enabling them.

Report-only:
  - Content-Security-Policy-Report-Only with a pragmatic allowlist:
      default-src 'self'
      script-src  'self' 'unsafe-inline' 'unsafe-eval'
      style-src   'self' 'unsafe-inline'
      img-src     'self' data: blob: https:
      font-src    'self' data:
      connect-src 'self' https://*.supabase.co wss://*.supabase.co
      frame-ancestors 'none'
      base-uri    'self'
      form-action 'self'
    'unsafe-inline' / 'unsafe-eval' are there because Next's inline
    hydration script + dev-mode require them; nonce-based CSP is a
    later project. Violations appear in the browser console but
    nothing is blocked until we flip the header name to
    `Content-Security-Policy`.

Verified against the running dev server:
  - /, /docs, /login, /api/whatsapp/webhook, /_next/static/* all
    return the six headers.
  - No CSP violations on / or /docs in the browser console.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 19:24:41 +03:00
.github ci: typecheck + build on every PR 2026-04-20 19:09:32 +03:00
docs fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
public Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
src fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
supabase/migrations feat(settings): user profile management 2026-04-20 17:40:39 +03:00
.env.local.example fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
.gitignore fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
AGENTS.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
CLAUDE.md Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
components.json feat: initial commit 2026-04-16 17:53:27 +03:00
eslint.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
next.config.ts security: baseline response headers (CSP report-only + OWASP set) 2026-04-20 19:24:41 +03:00
package-lock.json feat(docs): in-app docs viewer at /docs 2026-04-19 21:28:36 +03:00
package.json ci: typecheck + build on every PR 2026-04-20 19:09:32 +03:00
postcss.config.mjs Initial commit from Create Next App 2026-04-16 17:52:39 +03:00
README.md docs: end-to-end self-host setup guide 2026-04-19 20:52:08 +03:00
tsconfig.json Initial commit from Create Next App 2026-04-16 17:52:39 +03:00

README.md

WaCRM

Self-hostable WhatsApp CRM — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations — built on Next.js 16 and Supabase.

Quick start

git clone https://github.com/<your-username>/wacrm.git
cd wacrm
npm install
cp .env.local.example .env.local
# Fill in Supabase keys + ENCRYPTION_KEY, then:
npm run dev

Open http://localhost:3000.

For the full setup — Supabase migrations, WhatsApp Business API config, production deploy on Hostinger — see docs/.

Documentation

Stack

  • App — Next.js 16 (App Router), React 19, TypeScript, Tailwind v4.
  • Data — Supabase (Postgres + Auth + RLS).
  • WhatsApp — Meta Cloud API (official WhatsApp Business API).

License

MIT — fork it, brand it, host it. Pull requests welcome.