Should I vibe code
Short links, branded back-halves, QR codes, and click analytics
Twenty lines of code. But every link you shorten is a permanent promise to keep a server alive.
?
Their verdict, the Growth price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The redirect is trivial and that is exactly the trap. Short links end up in print, in other people’s posts and in emails you cannot recall, so the day your domain lapses you break the internet a little.
What actually breaks
not "if". the specific failures.
- The domain lapses, and every link ever shared becomes a dead end
- An open redirect turns your branded domain into a phishing vector
- The database is lost, and there is no way to reconstruct the mappings
- A traffic spike from one popular link takes the whole redirector down
- Your domain gets flagged by a safe-browsing list because of one abusive link
A conference badge from two years ago has a QR code on it. The QR code points at your short domain. The short domain expired last month because the renewal card had changed, and someone else registered it within the hour. Every one of those badges — and the slide deck, and the printed flyers, and the tweet with four hundred retweets — now points at whatever they decide to put there.
Is that you?
the verdict is a default, not a law
- The links are internal, disposable, and never printed or shared publicly
- You are shortening only your own URLs on a domain you own outright
- You have accepted that the service is now permanent infrastructure
- Anyone else can create links
- The links will end up on physical material, or anywhere you cannot edit later
- You are not prepared to keep the domain registered indefinitely
If you build it anyway
the checklist, then the prompt that enforces it
- Allowlist destination domains, or require authentication to create. An open redirector will be found and abused.
- Register the domain for the maximum term, enable auto-renew, and put the renewal on a card that does not expire before you do.
- Back up the mapping table off-box, and test the restore. This table is the entire product.
- Use 301 only once you are certain — browsers cache permanent redirects aggressively and a mistake is very hard to recall.
- Log clicks in aggregate, not per person, unless you are prepared to treat them as personal data.
- Reserve a static fallback page for unknown slugs that explains what the domain is, rather than 404ing.
I am building a URL shortener. Treat it as permanent infrastructure, not a weekend project, and enforce this: 1. Creation is authenticated. There is no unauthenticated create endpoint, even behind an obscure path. 2. Destination URLs are validated against an allowlist of schemes (https only) and, if I give you one, an allowlist of domains. Reject javascript:, data:, and anything that resolves to a private IP range. 3. Use 302 by default, not 301. Only promote a link to 301 through an explicit command, and warn me in the README that 301s are cached indefinitely by browsers and effectively cannot be recalled. 4. The slug -> URL mapping is the entire product. Write a backup command that dumps it to a plain CSV, run it on a schedule, and write a restore command in the same commit. Then tell me to actually test the restore. 5. Add a reserved-slug list so I cannot accidentally shadow /admin, /api or static assets. 6. Unknown slugs render a branded 'this link is not active' page, not a bare 404, so a dead link is explainable rather than mysterious. 7. Click tracking is aggregate only: a counter per slug. Do not log IPs or user agents per click unless I explicitly ask, and if I do, warn me that it becomes personal data. 8. Rate-limit both creation and redirects. 9. In the README, write a section headed 'This is now permanent' listing the domain renewal date, where backups live, and what breaks if the service stops.
That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
If links will ever appear on something you cannot edit — print, video, a slide deck someone else has — pay someone whose business model requires them to still exist in five years. That is the entire value proposition and it is worth more than $35 a month.
$35/mo is cheaper than your weekend.
Keep the mapping table exportable as CSV, and if you ever shut it down, do not just switch it off — replace the service with a static file that 302s every known slug to its destination. That costs nothing to host forever and keeps two years of printed material working.
The most complete open-source link platform · analytics, custom domains, QR codes. Self-hostable.
Self-hosted URL shortener with a REST API, click stats, and QR codes.
The long-running PHP shortener · drop it on any LAMP host and it works.
Questions
This is fifty lines of code. Why is it rated so harshly?
Because difficulty and consequence are different axes, and this site is about the second one. The code is trivial. The commitment — keeping a domain and a database alive indefinitely, because other people have embedded your links in things they cannot change — is not.
What makes it an abuse target?
A redirector on a domain nobody has flagged yet is exactly what a phisher wants. If anyone can create links, your domain is doing the work of making a malicious URL look safe, and it will end up on blocklists.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
It’s a static page with links on it. If you’re paying $9 a month for this, we need to talk.
It’s a library call. You are paying $15 a month for `npm i qrcode`.
Self-hosting analytics is the one case where doing it yourself is also the privacy-correct answer.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice