Checkerboard Royalty Partners
Overview
Checkerboard Royalty Partners buys mineral rights and oil and gas royalties directly from owners. I designed, built, and launched the company website as a freelance project, from the first layout through the custom domain, business email, and the form that brings in leads.
The site has four main pages, a home page, Sell Your Minerals, About, and Contact, plus a privacy policy. The colors come from the company logo, navy, gold, and cream on a warm paper background, with Newsreader for headings, Source Sans 3 for body text, and Cinzel for the wordmark.
The offer-request form
The form is the part of the site that does the work. An owner fills in their name, email, and the state and county of their interest, and can add the type of interest, a legal description, the operator or well name, whether they receive royalty checks, and a message. The fields are validated on the server before anything is sent.
Owners can attach up to five royalty check stub PDFs, 4MB in total, which is Vercel's request limit. The server checks each file itself rather than trusting its name, since every real PDF starts with the bytes "%PDF", so a renamed file is rejected.
Every request is delivered two ways. It goes out as an email through Resend with the check stubs attached, and it posts to a webhook, a Google Apps Script that adds a row to a Google Sheet the owners share. The webhook carries a shared secret so nothing else can write rows, and any value that looks like a spreadsheet formula is neutralized before it reaches the sheet, so a submission cannot run a formula on the owners' machines.
The plan was an Excel workbook on OneDrive, fed through a Make.com webhook, and the code for it is still in the repo. I could not get the Microsoft connection set up through my school domain, so I fell back to the Google Sheet, which needed nothing but the script and a secret.
Security and setup
Spam is handled twice. Cloudflare Turnstile runs a check on every submission and verifies it on the server, and a hidden field that only bots fill in quietly drops anything that trips it.
Every page sends standard hardening headers: the site refuses to be framed by other sites, browsers are told not to guess file types, links to other sites pass only the domain, and camera, microphone, and location access are switched off. The default header announcing the framework is turned off.
Outside the code, I set up the custom domain and business email with SPF and DKIM, so mail from the company's domain is not marked as spam, secured the accounts behind the site with two-factor authentication and access controls, wrote the data privacy policy, and set up SEO with a sitemap, robots file, and structured business details for search engines.
Status
Live at cbroyalty.com. The source is private.
