Target: Summer 2027 – Deliver a usable website meeting club member expectations.

Member self-service

• 24/7 self-service address change for club members
• Add a “last verified” timestamp field to the database – possbile email “Is your club information still up to date?”

Account & email structure

• Move email addresses to a secondary table linked to the primary account record
• Move childern to second table.
• Make membership generator to email/print/mail?
• Family accounts need multiple email addresses — Rick A. raised this
• One member must be flagged as the primary contact on a family account for ALCOR export compatibility. The person if is board memeber will need to be listed for ALCOR is some fashion
• ALCOR export formatting for family accounts: submit last name as first name, last name as “Family” — so Jane Doe’s Reflector label becomes “Doe Family”
• Determine how family accounts receive the electronic Reflector

Online join & renewal

• Full online join flow with pending status; online renewal with no credit card numbers stored
• Payment processor: Stripe or Square
  • Renewal: member must sign in before reaching the renewal button; page load populates the shared renewal form
  • Join: processor requires email address; all required fields must be completed before checkout is available
• Payment confirmation emails route to payments@boiseastro.org (shared mailbox, all board members)
  • Security note: payment confirmation emails are a threat vector. Mitigate by allowing only vendor-originated emails, or by relying on the processor’s own fraud controls. Board workflow: review email → review DB record → change status from pending to active via a link in the email

Board member tools

• Report: compare Group.io membership list against the roster to identify members who haven’t joined the list – with button to email out – Do you need help? you are not in group.io.
• Report: new members who haven’t received a welcome packet

CSS theme

• Replace current theme to match the main site
• Audit for any site-change warnings before deploying

Member authentication (self-service login)

• Generate a random 7-digit numeric code; SHA-256 hash it and store in the member record with a timestamp
• Send the code to the email address on file using the existing email API
• Member logs in with email + code; token valid for 2 hours

Database automation

• Dreamhost free tier is a shared cluster with no scheduled stored procedures
• Option A: add a task table; any page access checks and runs pending tasks — appears automated, fires on access
• Option B: upgrade to a Dreamhost VPS (~$4/month); requires AV and backup planning
  • Note: Jeff Creed currently backs up sites and pushes to the club’s Google Drive