// the find
ArnasDon/wacrm
Self-hostable CRM template for WhatsApp — shared inbox, contacts, sales pipelines, broadcasts, and no-code automations. Fork it, brand it, host it.
A fork-first CRM template for WhatsApp Business API built on Next.js 16 and Supabase. You get shared inbox, contact management, Kanban pipelines, broadcast campaigns, a no-code automation builder, and a bring-your-own-key AI assistant — all in one deployable codebase. The target is small teams who want WhatsApp as a customer channel without paying per-seat SaaS fees.
The security layer is not an afterthought: AES-256-GCM for token encryption, RLS on every Supabase table, HMAC-verified webhooks, and rate limiting on the API. That's a better baseline than most templates ship with. The AI integration is done right — your key, your data, no vendor intermediary, and the knowledge base uses pgvector hybrid retrieval instead of a naive prompt-stuffing approach. Test coverage is visible throughout the directory tree: unit tests on the automations engine, auth, contacts, AI chunking, embeddings, and the public API — not just happy-path smoke tests. The public REST API with scoped, revocable keys means you're not trapped in the UI if you need to automate externally.
The fork:star ratio (3,476 forks vs 1,387 stars) is unusual enough to notice — that inversion is more consistent with automated seeding or partnership distribution than organic developer interest, so treat the numbers skeptically. The Hostinger branding is heavy — two banner images and a dedicated 'why Hostinger' table in the README make the deployment recommendation feel like a paid placement, which is fine to know but means the self-host-anywhere claim is underplayed in docs. Automations run on serverless cron routes (`/api/automations/cron`, `/api/flows/cron`) rather than a persistent worker, so anything time-sensitive or with retry semantics depends entirely on your host's cron reliability — fragile on shared hosting and underdocumented as a limitation. WhatsApp Business API dependency is treated as infrastructure, not a risk: Meta template approvals, rate limits, and policy changes can break your CRM at any time with no fallback path, and the README doesn't acknowledge this.