4 Commits

Author SHA1 Message Date
078e7bc455 Add Insights article: The 90-Day Blind Spot: How HOA Boards Can Catch Delinquent Assessments Before They Snowball (2026-08-17)
- New article: articles/hoa-delinquency-management-guide.html
- Updated articles/index.html with new card (newest first)
- Updated sitemap.xml with new URL entry

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-08-17 08:22:17 -04:00
614a0edfa1 Merge pull request 'Block example.com emails and homesites under 10' (#26) from feature/block-example-domain-and-min-homesites into main
All checks were successful
Deploy to Production / deploy (push) Successful in 3s
2026-07-24 09:30:44 -04:00
1219117adf Block example.com emails and homesites under 10
Spam submissions were still getting through with placeholder data. Two
more content filters on the public form endpoints:

- Reject emails from reserved documentation domains (example.com/.org/
  /.net/.edu and subdomains) and reserved TLDs (.test/.example/.invalid/
  localhost). testing@example.com and friends are never real leads.
- Reject a homesites count below 10. Real associations are larger; the
  junk uses 0/1/2.

Both are validated server-side in security.js (validateEmail gains a
domain blocklist, new validateHomesites) and mirrored client-side in
app.js for immediate feedback. The homesites input min attribute goes
from 1 to 10. Blocked submissions return 400 with a `field` hint and
store nothing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-24 09:30:15 -04:00
5f4af3886c Merge pull request 'Validate email addresses on both public form endpoints' (#25) from feature/strict-email-validation into main
All checks were successful
Deploy to Production / deploy (push) Successful in 6s
2026-07-23 08:25:55 -04:00
7 changed files with 362 additions and 6 deletions

23
app.js
View File

@@ -125,12 +125,24 @@
// gives immediate feedback instead of a round-trip.
const EMAIL_RX = /^[A-Za-z0-9](?:[A-Za-z0-9._%+-]{0,62}[A-Za-z0-9])?@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*\.[A-Za-z]{2,24}$/;
// Reserved documentation domains / TLDs — mirrors security.js. Real leads
// never come from these; spam bots use them.
const BLOCKED_EMAIL_DOMAINS = ['example.com', 'example.org', 'example.net', 'example.edu'];
const BLOCKED_EMAIL_TLDS = ['test', 'example', 'invalid', 'localhost'];
function isValidEmail(v) {
if (v.length > 254 || v.indexOf('@') > 64) return false;
if (v.includes('..')) return false;
return EMAIL_RX.test(v);
if (!EMAIL_RX.test(v)) return false;
const domain = v.slice(v.indexOf('@') + 1).toLowerCase();
const tld = domain.slice(domain.lastIndexOf('.') + 1);
if (BLOCKED_EMAIL_TLDS.includes(tld)) return false;
if (BLOCKED_EMAIL_DOMAINS.some(d => domain === d || domain.endsWith('.' + d))) return false;
return true;
}
const MIN_HOMESITES = 10;
function showCalcError(msg) {
if (!calcErr) return;
calcErr.textContent = msg;
@@ -159,6 +171,12 @@
return;
}
if (homesites < MIN_HOMESITES) {
showCalcError(`Please enter the number of homesites in your community (minimum ${MIN_HOMESITES}).`);
document.getElementById('calcHomesites')?.focus();
return;
}
// Email is optional, but anything entered must be a real address.
if (calcEmail && !isValidEmail(calcEmail)) {
showCalcError('Please enter a valid email address.');
@@ -243,10 +261,11 @@
// is stored. AI/service errors (502/503) fall through to the local result.
if (!res.ok) {
const data = await res.json().catch(() => ({}));
if (data.blocked || data.field === 'email') {
if (data.blocked || data.field) {
setCalcLoading(false);
showCalcError(data.error || 'We could not verify this submission. Please try again.');
if (data.field === 'email') document.getElementById('calcEmail')?.focus();
if (data.field === 'homesites') document.getElementById('calcHomesites')?.focus();
resetCaptcha();
await fetchFormToken(); // tokens are single-use; issue a fresh one
return;

View File

@@ -0,0 +1,266 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>The 90-Day Blind Spot: How HOA Boards Can Catch Delinquent Assessments Before They Snowball | HOA LedgerIQ Insights</title>
<meta name="description" content="Most HOA boards discover payment problems 60-90 days too late. Here's how to spot delinquency trends early, protect cash flow, and collect with less friction." />
<meta name="keywords" content="HOA delinquent assessments, HOA dues collection, HOA delinquency management, community association collections, HOA cash flow delinquency, past due HOA dues, HOA accounts receivable" />
<link rel="canonical" href="https://www.hoaledgeriq.com/articles/hoa-delinquency-management-guide" />
<link rel="preconnect" href="https://fonts.googleapis.com" />
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap" rel="stylesheet" />
<link rel="stylesheet" href="../styles.css" />
<meta property="og:title" content="The 90-Day Blind Spot: How HOA Boards Can Catch Delinquent Assessments Before They Snowball" />
<meta property="og:description" content="A late payment that goes unnoticed for a quarter is a very different problem than one caught in week two. Here's how boards close that gap." />
<meta property="og:type" content="article" />
<meta property="og:url" content="https://www.hoaledgeriq.com/articles/hoa-delinquency-management-guide" />
<meta property="article:published_time" content="2026-08-17" />
<!-- Google tag (gtag.js) -->
<script async src="https://www.googletagmanager.com/gtag/js?id=G-RTWNVXPMRF"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-RTWNVXPMRF');
</script>
</head>
<body>
<!-- NAV -->
<nav class="nav">
<div class="nav-inner">
<a href="../index.html" class="nav-logo">
<img src="../logo_house_transparent.svg" alt="HOA LedgerIQ" class="logo-img" />
</a>
<ul class="nav-links">
<li><a href="../index.html">Home</a></li>
<li><a href="../index.html#features">Features</a></li>
<li><a href="../index.html#pricing">Pricing</a></li>
<li><a href="index.html" class="nav-active">Insights</a></li>
</ul>
<a href="https://app.hoaledgeriq.com/pricing" class="btn btn-primary nav-btn" target="_blank" rel="noopener">Start Free Trial</a>
<a href="https://app.hoaledgeriq.com" class="btn btn-outline nav-btn nav-login" target="_blank" rel="noopener">Login</a>
</div>
</nav>
<!-- Article Header -->
<header class="article-header">
<div class="container">
<nav class="article-breadcrumb">
<a href="../index.html">Home</a>
<span class="breadcrumb-separator">/</span>
<a href="index.html">Insights</a>
<span class="breadcrumb-separator">/</span>
<span>The 90-Day Blind Spot</span>
</nav>
<span class="article-tag">Financial Planning</span>
<h1 class="article-title">The 90-Day Blind Spot: How HOA Boards Can Catch Delinquent Assessments Before They Snowball</h1>
<p class="article-subtitle">A late payment caught in week two is a phone call. The same payment discovered ninety days later, tangled up with two more from the same household, is a collections case. Here's why the gap between those two outcomes is almost always about timing, not the homeowner.</p>
<div class="article-meta">
<span>HOA LedgerIQ Team</span>
<span class="meta-separator"></span>
<span>August 17, 2026</span>
<span class="meta-separator"></span>
<span>9 min read</span>
</div>
</div>
</header>
<!-- Article Body -->
<section class="article-body-section">
<div class="container">
<div class="article-prose">
<p class="lead">The treasurer of a 90-unit condo association pulled up the operating account one Tuesday morning and felt fine about what she saw: balance healthy, bills paid, nothing flagged. It wasn't until the property manager mentioned, almost in passing, that Unit 214 hadn't paid dues since May that the picture changed. A quick look through the ledger turned up two more units in the same position, one of them four months behind. None of it had shown up in the number she checked every week, because that number was the bank balance — and the bank balance doesn't know who owes what, only what's already arrived.</p>
<p>This is the quiet failure mode behind almost every serious HOA delinquency problem: not that boards ignore past-due accounts, but that the tools most communities rely on don't surface them until they're already large. A spreadsheet updated once a month, a management company report that lands two weeks after the period it covers, a mental model built entirely around "is the account funded" rather than "who's behind and by how much" — all of it adds up to the same result. Problems that started as a single missed payment get discovered only after they've compounded into three.</p>
<p>Delinquency management isn't a collections problem. It's a visibility problem that becomes a collections problem if it goes unaddressed long enough. Boards that catch it early spend a few minutes on a friendly reminder. Boards that catch it late spend months on liens, legal fees, and homeowners who feel ambushed by a bill that quietly tripled while nobody was watching.</p>
<h2>Why the Balance Sheet Hides the Problem</h2>
<p>Most HOA boards track exactly one number closely: how much is in the bank. It's the number on the agenda, the number the treasurer reports, the number that determines whether anyone feels anxious at a given meeting. The trouble is that a healthy bank balance and a healthy collections position are two completely different things, and a community can have the first without the second for a surprisingly long time.</p>
<p>A 150-unit community collecting $180,000 a year in assessments can have five households, four months behind, and still show a comfortable operating balance — because the other 145 households are paying on time and carrying the shortfall without anyone noticing. The cash is there. The compliance isn't. And because the top-line number looks fine, nothing prompts anyone to go looking for the households that aren't paying until the shortfall grows large enough to actually dent the balance — often not until it's a five-figure problem spread across a dozen accounts instead of a four-figure one spread across three.</p>
<blockquote>
"Our bank balance never once told us we had a problem. By the time it did, we were already chasing eleven months of one homeowner's dues and the attorney's letter cost more than the first three months would have." — HOA Board Treasurer, Mesa, AZ
</blockquote>
<div class="highlight-box">
<strong>The core issue:</strong> Bank balance measures whether the community as a whole is solvent this month. Delinquency measures whether individual households are current. A board can be blind to the second while feeling reassured by the first — often for quarters at a time.
</div>
<h2>The Real Cost of Discovering It Late</h2>
<p>The financial cost of a delinquent account grows in a predictable, almost mechanical way, and understanding that curve is what makes early detection worth the effort. A payment that's two weeks late is usually just late — a bounced autopay, a forgotten check, a homeowner who meant to get to it. A friendly reminder resolves the overwhelming majority of these without any further action needed.</p>
<p>Once an account crosses 60 to 90 days, the dynamics change. Many governing documents require formal notice at that point, which means legal or management fees start accruing on top of the original balance. The homeowner, who might have paid promptly given an early nudge, is now facing a bill inflated by fees they view as punitive, which makes them more likely to dispute it, delay further, or dig in defensively rather than simply pay. What started as a $400 quarterly assessment can become an $1,100 collections matter — not because the homeowner suddenly became less willing to pay, but because nobody caught the original miss in time to keep it small.</p>
<p>Multiply that pattern across a handful of accounts in any given year and the aggregate cost is significant: legal fees the association fronts and may never fully recover, board time spent on collections instead of capital planning, and — often overlooked — the reserve and operating shortfalls created while those balances sit uncollected. A community that carries $30,000 in aged receivables for eight months isn't just missing that money; it's potentially delaying a project, drawing down a cushion, or quietly leaning on other homeowners' timely payments to cover the gap.</p>
<div class="highlight-box">
<strong>What to ask:</strong> "What's our current total in receivables aged past 30 days, 60 days, and 90 days — and how has that total moved over the last six months?"
</div>
<h2>Delinquency Is a Trend, Not a List</h2>
<p>A snapshot of who's currently behind is useful, but it answers the wrong question. The more important question is whether the total owed is growing, shrinking, or holding steady — and whether the accounts on this month's list are the same names as last month's, or new ones. A static list treated as a to-do item gets worked through account by account; a trend, tracked consistently, tells a board something structural is worth investigating.</p>
<p>If the same three households appear on the delinquency list every month, that's a pattern worth a direct, individual conversation — sometimes it's a payment plan, sometimes a hardship, sometimes simply a homeowner who needs an easier way to pay. If the total number of delinquent accounts is climbing steadily across the community rather than concentrated in a few households, that's a different signal entirely — possibly an assessment increase that landed harder than expected, or a payment process that's become inconvenient enough that otherwise reliable homeowners are falling behind on logistics, not intent.</p>
<p>Boards that only look at delinquency once a quarter, when the management report happens to include it, miss the moment when a one-off miss turns into a pattern. By the time the quarterly report shows the trend clearly, three more payment cycles have passed — three more chances for a $400 miss to become an $1,100 one.</p>
<div class="highlight-box">
<strong>The bottom line:</strong> One month's delinquency list tells you who to call. Six months of delinquency totals, tracked together, tell you whether your collections process is working or quietly falling behind.
</div>
<h2>Building the Early-Warning Habit</h2>
<p>The boards that manage delinquency well share a common trait: they've turned it into a habit measured in days, not a review measured in quarters. That doesn't require a full-time staff member or expensive software — it requires treating "who hasn't paid yet" as a number worth checking as often as the bank balance, and building a light, consistent process around what happens when someone shows up on that list.</p>
<p>In practice, that usually looks like a short, predictable escalation: a friendly automated reminder at 15 days past due, a personal note or call at 30 days, and a clear, calmly worded formal notice at 60 days if nothing has changed — well before the point where governing documents require legal involvement. Each step is small and low-cost on its own, but strung together they catch the overwhelming majority of late payments long before they become collections cases, and they do it in a way most homeowners experience as a helpful nudge rather than an accusation.</p>
<p>The other half of the habit is simply reviewing the aging trend regularly — weekly or biweekly rather than quarterly — so a shift in the pattern gets noticed within days instead of months. That single change, moving from a quarterly glance to a routine check, is often what separates communities that resolve delinquency with a phone call from communities that resolve it with an attorney.</p>
<h2>What This Looks Like in Practice</h2>
<p>Copperfield Commons is a 210-unit community outside Charlotte that used to review delinquency the same way most associations do: a line item on the quarterly management report, glanced at, filed away. In early 2025, the board discovered — three months after the fact — that a homeowner who'd always paid on time had missed four consecutive months following a job loss, and the balance had grown large enough that a lien filing was already in motion by the time anyone on the board had a conversation with them.</p>
<p>The board changed one thing: instead of waiting for the quarterly report, they started reviewing a simple aging summary every two weeks — current, 30 days, 60 days, 90-plus — and treating any account that appeared for a second consecutive check as a call, not just a line item. Within the first quarter of the new habit, they caught two accounts at the 20-day mark that would previously have gone unnoticed until the next report, resolved both with a short conversation and a modest payment plan, and avoided any legal fees on either.</p>
<p>A year later, Copperfield's aged receivables — the total sitting past 60 days — had dropped by more than 70%, not because homeowners had become more reliable, but because the board was catching the same rate of missed payments dramatically earlier, when a phone call was still enough to fix it. The delinquency total is now a number the treasurer reports with the same routine confidence as the bank balance, because it's checked just as often.</p>
<blockquote>
"We didn't get better at collections. We got faster at noticing. That turned out to be almost the entire fix." — Copperfield Commons HOA Treasurer
</blockquote>
<div class="highlight-box">
<strong>The bottom line:</strong> Delinquency doesn't become a crisis because homeowners stop paying — it becomes a crisis because boards don't notice quickly enough to intervene while intervention is still simple. Checking the aging trend as often as the bank balance is the single highest-leverage habit a board can build.
</div>
<p>Every HOA will have a late payment eventually — a bounced autopay, a forgotten check, a homeowner going through a hard stretch. That part is unavoidable. What's avoidable is the ninety-day gap between when it happens and when the board finds out, and closing that gap doesn't take a bigger budget or a harder line with homeowners. It takes checking the right number often enough to catch the problem while it's still small enough to be a conversation instead of a case.</p>
</div>
</div>
</section>
<!-- SCREENSHOT CAROUSEL -->
<section class="article-showcase">
<div class="container">
<div class="article-showcase-header">
<div class="section-label">See How Modern HOA Financial Management Works</div>
<h2>HOA LedgerIQ surfaces delinquency trends continuously — not just when the quarterly report lands</h2>
</div>
<div class="screenshot-carousel" id="screenshotCarousel">
<div class="carousel-frame">
<div class="carousel-slides">
<div class="carousel-slide active">
<img src="../img/screenshot-dashboard.png" alt="HOA LedgerIQ Dashboard — Fund health scores, operating and reserve balances" />
<div class="slide-caption">A live dashboard that tracks aging receivables alongside your bank balance, not separately from it</div>
</div>
<div class="carousel-slide">
<img src="../img/screenshot-cashflow.png" alt="HOA LedgerIQ Cash Flow — Projected balances with forward forecasting chart" />
<div class="slide-caption">Forward cash flow forecasting that accounts for uncollected assessments, not just what's already in the bank</div>
</div>
<div class="carousel-slide">
<img src="../img/screenshot-capital.png" alt="HOA LedgerIQ Capital Planning — Multi-year project timeline and budget view" />
<div class="slide-caption">Component-level capital planning that stays accurate because collections stay on track</div>
</div>
</div>
</div>
<div class="carousel-controls">
<button class="carousel-btn carousel-prev" aria-label="Previous screenshot">&#8592;</button>
<div class="carousel-dots">
<span class="carousel-dot active" data-index="0"></span>
<span class="carousel-dot" data-index="1"></span>
<span class="carousel-dot" data-index="2"></span>
</div>
<button class="carousel-btn carousel-next" aria-label="Next screenshot">&#8594;</button>
</div>
</div>
</div>
</section>
<!-- CTA Section -->
<section class="article-cta">
<div class="container">
<h2>Ready to Catch Delinquency Before It Compounds?</h2>
<p>HOA LedgerIQ tracks aging receivables alongside your cash position in real time — so a missed payment shows up in days, not the next quarterly report.</p>
<a href="https://app.hoaledgeriq.com/pricing" class="btn btn-primary btn-large" target="_blank" rel="noopener">Start Your Free 14-Day Trial</a>
<p class="cta-note">No credit card required · 14-day free trial · No contracts</p>
</div>
</section>
<!-- Article Navigation -->
<nav class="article-nav">
<div class="container">
<div class="article-nav-grid">
<a href="hoa-reserve-fund-health-score.html" class="article-nav-prev">
<span class="nav-label">Previous Article</span>
<span class="nav-title">How to Read Your HOA's Reserve Fund Health Score</span>
</a>
<a href="hoa-cash-flow-management-mistakes.html" class="article-nav-next">
<span class="nav-label">More Reading</span>
<span class="nav-title">What HOA Boards Get Wrong About Cash Flow Management</span>
</a>
</div>
</div>
</nav>
<!-- FOOTER -->
<footer class="footer">
<div class="container footer-inner">
<div class="footer-logo">
<img src="../logo_house.svg" alt="HOA LedgerIQ" class="logo-img logo-img--footer" />
<p>AI-powered HOA finance management.</p>
</div>
<div class="footer-links">
<div class="footer-col">
<div class="footer-col-title">Product</div>
<a href="../index.html#features">Features</a>
<a href="../index.html#pricing">Pricing</a>
<a href="https://app.hoaledgeriq.com/pricing" target="_blank" rel="noopener">Start Free Trial</a>
</div>
<div class="footer-col">
<div class="footer-col-title">Pages</div>
<a href="../investment-management.html">Investment Management</a>
<a href="../reserve-study-software.html">Reserve Studies</a>
<a href="index.html">Insights</a>
</div>
<div class="footer-col">
<div class="footer-col-title">Legal</div>
<a href="../privacy.html">Privacy Policy</a>
<a href="../terms.html">Terms of Service</a>
</div>
</div>
</div>
<div class="footer-bottom">
<div class="container">
<span>&copy; 2026 HOA LedgerIQ. All rights reserved.</span>
</div>
</div>
</footer>
<script src="../app.js"></script>
<!-- Support Chat Widget -->
<script>
(function(d,t) {
var BASE_URL="https://chat.hoaledgeriq.com";
var g=d.createElement(t),s=d.getElementsByTagName(t)[0];
g.src=BASE_URL+"/packs/js/sdk.js";
g.async = true;
s.parentNode.insertBefore(g,s);
g.onload=function(){
window.chatwootSDK.run({
websiteToken: '1QMW1fycL5xHvd6XMfg4Dbb4',
baseUrl: BASE_URL
})
}
})(document,"script");
</script>
</body>
</html>

View File

@@ -54,6 +54,21 @@
<div class="article-grid">
<!-- Article 11 — Newest first -->
<a href="hoa-delinquency-management-guide.html" class="article-card" style="text-decoration:none;">
<span class="article-card-tag">Financial Planning</span>
<h2 class="article-card-title">The 90-Day Blind Spot: How HOA Boards Can Catch Delinquent Assessments Before They Snowball</h2>
<p class="article-card-excerpt">A late payment caught in week two is a phone call. The same payment discovered ninety days later is a collections case. Here's how boards close that gap and stop small misses from compounding into liens and legal fees.</p>
<div class="article-card-meta">
<span>HOA LedgerIQ Team</span>
<span class="article-card-meta-dot"></span>
<span>August 17, 2026</span>
<span class="article-card-meta-dot"></span>
<span>9 min read</span>
</div>
<span class="article-card-read-more">Read article →</span>
</a>
<!-- Article 10 — Newest first -->
<a href="hoa-reserve-fund-health-score.html" class="article-card" style="text-decoration:none;">
<span class="article-card-tag">Reserve Funds</span>

View File

@@ -469,7 +469,7 @@
<div class="calc-grid">
<div class="calc-field">
<label for="calcHomesites">Number of homesites</label>
<input type="number" id="calcHomesites" placeholder="e.g. 150" min="1" />
<input type="number" id="calcHomesites" placeholder="e.g. 150" min="10" />
</div>
<div class="calc-field">
<label for="calcPropertyType">Property type</label>

View File

@@ -147,6 +147,8 @@ const MESSAGES = {
email_required: 'Please enter your email address.',
email_invalid: 'Please enter a valid email address.',
email_too_long: 'That email address is too long.',
email_blocked: 'Please use a valid work or personal email address.',
homesites_too_low: 'Please enter the number of homesites in your community (minimum 10).',
};
const STATUS = { rate_limited: 429, honeypot: 400 };
@@ -167,6 +169,26 @@ const EMAIL_RX = /^[A-Za-z0-9](?:[A-Za-z0-9._%+-]{0,62}[A-Za-z0-9])?@[A-Za-z0-9]
// C0/C1 control characters and DEL — includes the CR/LF used for header injection.
const CONTROL_CHARS_RX = /[\x00-\x1F\x7F-\x9F]/;
// Domains that are never a real lead. These are the IANA reserved documentation
// domains (RFC 2606) plus reserved TLDs, which is what spam bots reach for.
// A submitted domain is blocked when it equals one of these or is a subdomain
// of one (e.g. `mail.example.com`).
const BLOCKED_EMAIL_DOMAINS = new Set([
'example.com', 'example.org', 'example.net', 'example.edu',
]);
const BLOCKED_EMAIL_TLDS = new Set(['test', 'example', 'invalid', 'localhost']);
function isBlockedDomain(domain) {
const d = domain.toLowerCase();
const tld = d.slice(d.lastIndexOf('.') + 1);
if (BLOCKED_EMAIL_TLDS.has(tld)) return true;
for (const blocked of BLOCKED_EMAIL_DOMAINS) {
if (d === blocked || d.endsWith('.' + blocked)) return true;
}
return false;
}
/**
* Validate an email address.
* Returns { ok: true, email } with the normalised (trimmed, lower-cased) value,
@@ -204,10 +226,28 @@ function validateEmail(raw, { required = true } = {}) {
if (local.length > 64 || domain.length > 253) return { ok: false, reason: 'email_too_long' };
if (email.includes('..')) return { ok: false, reason: 'email_invalid' };
if (!EMAIL_RX.test(email)) return { ok: false, reason: 'email_invalid' };
if (isBlockedDomain(domain)) return { ok: false, reason: 'email_blocked' };
return { ok: true, email: email.toLowerCase() };
}
// ── Homesites validation ─────────────────────────────────
// Real associations have at least this many units; smaller values are the
// placeholder junk (0, 1, 2…) the spam submissions use.
const MIN_HOMESITES = 10;
/**
* Validate a homesites count.
* Returns { ok: true, homesites } (a finite number) or { ok: false, reason }.
*/
function validateHomesites(raw) {
const n = typeof raw === 'number' ? raw : parseFloat(raw);
if (!Number.isFinite(n) || n < MIN_HOMESITES) {
return { ok: false, reason: 'homesites_too_low' };
}
return { ok: true, homesites: n };
}
/**
* Run every protection layer for a public form POST.
* Returns { ok: true, ip } or { ok: false, status, error, reason }.
@@ -276,6 +316,8 @@ module.exports = {
issueFormToken,
guardSubmission,
validateEmail,
validateHomesites,
MIN_HOMESITES,
messageFor,
publicConfig,
clientIp,

View File

@@ -234,10 +234,17 @@ app.post('/api/calculate', async (req, res) => {
}
const cleanEmail = emailCheck.email;
if (!homesites || !annualIncome) {
if (!annualIncome) {
return res.status(400).json({ error: 'homesites and annualIncome are required.' });
}
// Homesites must be a real community size; tiny/placeholder values are spam.
const homesitesCheck = security.validateHomesites(homesites);
if (!homesitesCheck.ok) {
console.warn(`[abuse] rejected homesites from ${guard.ip}: ${JSON.stringify(homesites)}`);
return res.status(400).json({ error: security.messageFor(homesitesCheck.reason), field: 'homesites' });
}
if (!aiClient) {
saveCalcSubmission(null);
return res.status(503).json({ error: 'AI service not configured.' });

View File

@@ -37,11 +37,18 @@
<!-- Insights / Blog -->
<url>
<loc>https://www.hoaledgeriq.com/articles/</loc>
<lastmod>2026-07-15</lastmod>
<lastmod>2026-08-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.85</priority>
</url>
<url>
<loc>https://www.hoaledgeriq.com/articles/hoa-delinquency-management-guide</loc>
<lastmod>2026-08-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.80</priority>
</url>
<url>
<loc>https://www.hoaledgeriq.com/articles/hoa-reserve-fund-health-score</loc>
<lastmod>2026-07-15</lastmod>