Should I vibe code
Send Markdown newsletters from a small list with archives and simple automations
Small list, same law. The compliance floor does not scale down with your subscriber count.
?
Their verdict, the Basic price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Rendering Markdown and hitting a sending API is genuinely easy, and for a tiny list this is the most defensible build on the email list. You still owe unsubscribes, suppression and consent records from the first send.
What actually breaks
not "if". the specific failures.
- The belief that a small list is exempt, when neither CAN-SPAM nor GDPR has a subscriber-count threshold
- Consent records nobody kept, because at forty subscribers it felt like overkill and at four hundred it is unrecoverable
- Reputation, which is harder to hold at low volume — providers have too little signal to trust you and one complaint is a large fraction
- Markdown rendering to HTML email, where the rules are from 2003 and your CSS is not one of them
- An import from a spreadsheet of people who were, honestly, never asked
You start with forty friends and it is obviously fine. Eighteen months later there are six hundred people and you genuinely cannot say how a third of them arrived — some typed it in, some came from a conference list, some you added because they asked in a hallway. Then someone replies asking where you got their address and, separately, to be removed under GDPR. The removal is easy. The first question is the one you cannot answer, because the record you needed was a timestamp you did not think to store on the day it would have cost nothing.
Is that you?
the verdict is a default, not a law
- Double opt-in from the first subscriber, with consent stored from the very first signup
- Sending is a provider's API and the list is people who typed their own address
- You are rendering Markdown and nothing is imported from anywhere
- Any subscriber arrived from a list, an export, or a hallway conversation
- You cannot produce a consent timestamp for an arbitrary subscriber
- Unsubscribe is not one click and immediate
- You are treating 'it's only a few hundred people' as a reason to skip any of this
If you build it anyway
the checklist, then the prompt that enforces it
- Store consent from subscriber one: timestamp, source and IP. This costs nothing on day one and cannot be reconstructed on day five hundred.
- Double opt-in always. It is the cheapest way to keep typo'd and hostile signups off a list you cannot afford complaints on.
- One-click unsubscribe plus List-Unsubscribe headers, honoured immediately, from the first send.
- Never import a list. If a subscriber did not personally submit their address to you, send them nothing.
- Render email HTML with inline styles and a table-based layout, and test in a real client rather than a browser.
- Send through a provider API and keep volume steady rather than spiky — irregular sending is itself a deliverability problem at small scale.
Before you write a newsletter tool for a small list, apply these and push back if I ask you to break them.
1. Tell me at the start that the compliance floor does not scale with list
size. CAN-SPAM and GDPR have no hobbyist exemption, and a forty-person list
owes the same unsubscribe, consent and identification obligations as a
forty-thousand-person one.
2. Store consent from the first subscriber: timestamp, source, IP. Reject any
code path that creates a subscriber without them. Explain that this is
trivial now and impossible to reconstruct later.
3. Implement double opt-in before any send capability exists.
4. Implement one-click unsubscribe with List-Unsubscribe and
List-Unsubscribe-Post headers, honoured immediately and permanently, before
the first send.
5. Refuse to build a bulk import from CSV or a spreadsheet. If I insist, require
a per-row consent timestamp and source, and fail rows that lack them.
6. Send through an established provider's API. Configure SPF, DKIM and DMARC
and verify DKIM alignment.
7. For rendering: inline all CSS, use table-based layout, provide a plain-text
alternative part, and tell me to test in a real mail client rather than a
browser preview.
8. Include a physical postal address in the footer of every commercial send.
Ask me for it; do not invent a placeholder.
9. Suppress permanently on hard bounce and complaint, tracked per address.
10. Tell me that at $9 a month this is one of the cheapest things on the list,
and that what I am buying is the consent and unsubscribe machinery I am
otherwise promising to maintain personally.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
At $9 a month the arithmetic barely needs doing. This is the most defensible build on the email list — Markdown in, provider API out — but what you save is an evening, and what you take on is a permanent obligation to keep the unsubscribe path working.
$9/mo is cheaper than your weekend.
Export subscribers with consent records and opt-out status as CSV from the first week, and keep issues as Markdown files in version control. The consent column is the one that makes the list usable somewhere else — a list without it is a list you cannot legally mail from a new provider.
Mature open-source newsletter and mailing-list manager.
Questions
Forty friends who asked for it. Surely the law isn't aimed at me?
It is not aimed at you, but it does not exempt you either — the obligations attach to commercial email, not to volume. In practice the risk at your size is not enforcement, it is that the list grows past the point where you remember how each person arrived, and by then the records you needed were never created.
Why is deliverability harder for a small list?
Providers build reputation from volume and consistency, and you supply little of either. A single spam complaint from a forty-person send is a far worse ratio than one from forty thousand, and irregular sending — three issues this month, none for a quarter — reads as suspicious in itself.
- CAN-SPAM Act: A Compliance Guide for Business (FTC)
- GDPR Art. 7 — conditions for consent (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
The unsubscribe link is the regulated part, and it is the part you will implement last.
Sending bulk email is 5% code and 95% not getting your domain blacklisted forever.
Your reputation as a sender is an asset you can destroy in one bad loop and never rebuild.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice