Initial commit: SKEEN Derma Experts - Sistema Integral de Gestión Clínica

- Frontend React (SKEEN Brand) con Vite, TypeScript, Tailwind
- Frontend Homenest (versión alternativa)
- Módulos Odoo 17 custom (citas, pacientes, monedero, pagos, ventas, inventario, whatsapp)
- WACRM fork (Next.js 16 + Supabase)
- Hermes + Bridge + Skills (Qwen3.6 via Nan Builders)
- Scripts de migración y operación
- Documentación extensiva en docs/

wacrm/.github/SECURITY.md

@@ -0,0 +1,62 @@
+# Security Policy
+
+Thanks for taking the time to look into the security of this template.
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for security bugs.** Public issues are
+indexed by search engines and seen by every fork long before the upstream fix
+lands.
+
+Instead, please report privately via one of:
+
+- [GitHub Security Advisories](https://github.com/ArnasDon/wacrm/security/advisories/new)
+  (preferred — keeps the disclosure, fix, and CVE all in one place).
+- Email: `a.donauskas@hostinger.com` with `[CRM template security]` in the subject.
+
+Include, if you can:
+
+- A description of the issue and the impact.
+- Reproduction steps or a proof-of-concept.
+- The commit or release you're testing against.
+- Whether you'd like credit in the eventual disclosure (we default to
+  crediting by the name or handle you give us, unless you prefer anonymous).
+
+## What to expect
+
+- **Acknowledgement** within 72 hours.
+- **Initial assessment** (severity, affected versions, whether a workaround
+  exists) within one week.
+- **Fix + coordinated disclosure** on a timeline proportional to severity.
+  Critical issues ship a patch as soon as one's ready; medium issues bundle
+  with the next release.
+
+## Scope
+
+In scope:
+- Anything in this repository (`ArnasDon/wacrm`), including webhook and auth
+  flows, token encryption, RLS policies, and the built-in cron endpoints.
+- Default configurations shipped in `docs/` — e.g. if the setup guide leaves
+  an unsafe default.
+
+Out of scope:
+- Vulnerabilities in Supabase, Next.js, Node.js, or other upstream
+  dependencies — please report those to their maintainers. We'll happily
+  bump versions on request.
+- Issues that require a pre-compromised deployment (e.g. a leaked
+  service-role key) unless they widen the blast radius beyond the initial
+  compromise.
+- Social engineering, physical attacks, or third-party services your fork
+  adds after deploy.
+
+## Safe harbor
+
+Research conducted under this policy is authorized. We won't pursue legal
+action against anyone who:
+
+- Makes a good-faith effort to avoid data destruction, privacy violations,
+  or service disruption.
+- Gives us reasonable time to respond before any public disclosure.
+- Doesn't exploit the issue beyond what's necessary to demonstrate it.
+
+Thanks for helping keep this template (and its forks) safe.