- Shipped
- September 5, 2026 at 5:33 PM UTC
- Author
- Kamo
- Commit
- 7347ccf
Three things the public loan-application site could not previously be told, and one it was told wrongly. **Company Info gains Privacy Policy Address and Terms of Service Address.** Both optional. Both normalized to an absolute URL on blur and again on the server, because the value lands in an `href` on pages anyone can open, and a bare host with no scheme resolves there as a RELATIVE path — the link stays present, styled and clickable, and 404s for every visitor. `app/lib/webAddress.ts` mirrors the shared library's `WebAddresses.normalize` so the box shows what will actually be stored rather than surprising the operator after a reload. **A State Licensing pane, under Company Info.** The mortgage application page shipped a hardcoded California disclosure — "Licensed by the Department of Business Oversight under the California Residential Mortgage Lending Act" — served under every tenant's logo, including tenants never licensed in California. That is a false regulatory statement made in a customer's name. There was no data source that could have made it true, so this is that source: per-state licence name, number, regulator, complaints line, and an optional exact wording that prints verbatim. An organization that enters nothing prints nothing; the pane shows the composed sentence before you save it, because the alternative to reading it here is hearing about it from a borrower. **Vendors & Products carries a copyable application link per product.** `https://apps.<verified **************** falling back to apps.kamocrm.com — and the alert above the table says plainly that the platform host is not a lesser link, because an operator who assumes it shows Kamo's branding will not send it. It does not: the page resolves the lender from the product id in the path. The base comes from the server (`verifiedRootDomain`, the same predicate sign-in routes on), never from the browser's hostname, so nobody is handed an address whose DNS has never been aimed at us. Only markets whose products actually have a page get the column; the others would 404. `npm test` green: 447 files, 5525 tests, and all fourteen guards.