mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00

Arnas Donauskas faee4eea44

chore: rename product to "CRM Template for WhatsApp"

Drops the "WaCRM" branded name across user-facing surfaces in favour
of a descriptive name. Branded names that imply WhatsApp ownership or
sponsorship are a trademark fair-use risk; a relationship-based name
("CRM Template for WhatsApp") sidesteps that.

Scope:
- Brand text in nav, sidebar, footer, docs shell, mock window chrome.
- SITE_NAME / SITE_DESCRIPTION / legalName in src/lib/seo/site-config.ts.
- README, CONTRIBUTING, docs/, .github/ templates and policies.
- package.json description.
- Auth pages, settings copy, FAQ, code comments.

Out of scope (intentionally — these are infra renames the project
owner should drive separately so links and the package lockfile stay
consistent):
- The github.com/ArnasDon/wacrm repo URL.
- The wacrm.tech domain / homepage field.
- The package.json "name" field.
- The Hostinger application name and Meta system-user name in deploy
  docs (existing-deployment instructions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-06 11:52:11 +03:00

2.3 KiB

Raw Blame History

Security Policy

Thanks for taking the time to look into the security of this template.

Reporting a vulnerability

Do not open a public GitHub issue for security bugs. Public issues are indexed by search engines and seen by every fork long before the upstream fix lands.

Instead, please report privately via one of:

GitHub Security Advisories (preferred — keeps the disclosure, fix, and CVE all in one place).
Email: a.donauskas@hostinger.com with [CRM template security] in the subject.

Include, if you can:

A description of the issue and the impact.
Reproduction steps or a proof-of-concept.
The commit or release you're testing against.
Whether you'd like credit in the eventual disclosure (we default to crediting by the name or handle you give us, unless you prefer anonymous).

What to expect

Acknowledgement within 72 hours.
Initial assessment (severity, affected versions, whether a workaround exists) within one week.
Fix + coordinated disclosure on a timeline proportional to severity. Critical issues ship a patch as soon as one's ready; medium issues bundle with the next release.

Scope

In scope:

Anything in this repository (ArnasDon/wacrm), including webhook and auth flows, token encryption, RLS policies, and the built-in cron endpoints.
Default configurations shipped in docs/ — e.g. if the setup guide leaves an unsafe default.

Out of scope:

Vulnerabilities in Supabase, Next.js, Node.js, or other upstream dependencies — please report those to their maintainers. We'll happily bump versions on request.
Issues that require a pre-compromised deployment (e.g. a leaked service-role key) unless they widen the blast radius beyond the initial compromise.
Social engineering, physical attacks, or third-party services your fork adds after deploy.

Safe harbor

Research conducted under this policy is authorized. We won't pursue legal action against anyone who:

Makes a good-faith effort to avoid data destruction, privacy violations, or service disruption.
Gives us reasonable time to respond before any public disclosure.
Doesn't exploit the issue beyond what's necessary to demonstrate it.

Thanks for helping keep this template (and its forks) safe.

2.3 KiB Raw Blame History