Should I vibe code
Portfolio sites, client galleries, workflow tools, and online store
Your portfolio is built to be crawled. The gallery beside it holds a campaign that has not launched yet.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-05.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Read the tagline slowly: portfolio sites, client galleries, workflow tools, online store. Only the first of those is a website. The portfolio really is a Saturday — a grid, a lightbox, a domain — and the Carbonmade entry already covers why the resize pipeline is the hard part of it. What sits behind it here is the back office of a working commercial artist, and the galleries are not holiday snaps. They hold the campaign that has not run, the product that has not shipped, the editorial with a press date, delivered to an agency under a contract with a number in it. That is a different failure from a leaked wedding album: nobody is embarrassed, somebody is in breach. Stack contracts a client actually signs and a store that takes real orders on top, and you have three legal artefacts hanging off a site whose entire purpose is to be indexed as aggressively as possible — which is exactly the tension an agent resolves wrongly, by putting the public work and the embargoed work in the same images directory because that is what makes the uploader simple.
What actually breaks
not "if". the specific failures.
- The boundary between the public site and the private galleries, when both render out of one images directory and the sitemap generator has no idea which is which
- Embargo, which is a date your schema does not have a column for — a gallery is either private or not, and nothing in the app knows that this one becomes safe on 4 September and that one never does
- Contracts, which you are now generating, storing and having to reproduce two years later out of a table you designed in an afternoon and a PDF renderer you never pinned a version of
- The store, the first time a print order arrives with a shipping address, a refund request and a customer who wants to know where it is
- The contact form, because that is the actual product: a portfolio that renders beautifully and drops enquiries into a spam folder is worse than no portfolio, and it fails silently in exactly that direction
- Your domain and its certificate, which is the address on every business card, email signature and directory listing you have ever filled in, and whose expiry you will find out about from a friend
- File transfers, since 'send the client 10GB' is a feature Format sells and an object-storage bill you will forget you agreed to
- Colour management on the public side, where a resizer that quietly drops the ICC profile makes every piece in your portfolio look slightly wrong to the one audience trained to notice
The shoot was in February, for a product going on sale in September, and the agency's agreement had a confidentiality clause you skimmed on your phone. You delivered through your own gallery in March, because you had built one and it worked. In July a trade journalist emails asking for comment on the redesign, and you have never spoken to a journalist in your life. What happened is not a break-in. Your static site generator walks the images directory to build the sitemap, gallery uploads land in that directory one level down from the portfolio, and so your own sitemap published the path, a crawler took it, and an image search finished the job eleven weeks before launch. Everything behaved as written. The agency's lawyer is perfectly polite on the phone. The clause is not, and it is denominated in a percentage of the campaign budget rather than in what you were paid to shoot it.
Is that you?
the verdict is a default, not a law
- It is your portfolio and nothing else: your work, a lightbox, a contact form, no logins, no uploads from anyone but you
- Client delivery goes through something you pay for, and your site links to it rather than hosting it
- The store is a hosted checkout whose card details you never see, and orders arrive as email you fulfil by hand
- You would know within the hour if the site were down or the contact form had stopped delivering, because you have a check that tells you
- Any gallery holds work under embargo, an NDA or a press date
- The public site and the private galleries share an image directory, a CDN path, a sitemap or a thumbnail cache
- You are generating contracts people sign and cannot say where those documents will be in three years
- The store touches card details anywhere other than a hosted checkout
- You are hosting other artists' portfolios, which makes you a hosting company with one point of failure and nobody on call
If you build it anyway
the checklist, then the prompt that enforces it
- Keep public and private on two separate storage buckets with two separate hostnames. Not two directories, not two prefixes — two buckets, so a misconfigured policy on one cannot reach the other.
- Exclude private storage from the sitemap generator by construction rather than by rule: if the generator can only see the public bucket, it cannot leak the other one.
- Serve every gallery image through a short-lived signed URL issued after the gate passes, and verify from a machine with no credentials that an anonymous request returns 403. Check the thumbnail path separately; it is the one people forget.
- Record per gallery what the client agreed to and when it stops being confidential, and make the app refuse to publish anything with a live embargo to any public surface.
- Contracts are documents, not rows. Store the rendered PDF, its hash and the signing timestamp as immutable objects, and make sure you can produce them without the application running.
- Use a hosted checkout. Your code should never see a card number, and your database should never contain one, however convenient a payments table looks.
- Strip GPS from EXIF on anything downloadable and keep the copyright and creator fields, which is the opposite of what most one-line strip commands do.
- Monitor the contact form end to end — send a real message from outside your network on a schedule and alert when it does not arrive. Uptime on a portfolio means enquiries arriving, not the page rendering.
I am building a portfolio site that also holds private client galleries,
signed contracts and a small store. The public half exists to be indexed;
the private half must never be. Build that separation first and refuse to
blur it.
1. Two buckets with two hostnames, from the first commit: one public, one
private. Never one bucket with a private prefix, and tell me why prefixes
fail.
2. The sitemap and every crawler-facing index may read only the public
bucket.
3. Every private byte, previews and thumbnails included, is served through a
short-lived signed URL issued after the gallery gate passes.
4. If I ask you to serve gallery images from a static path because the grid
feels slow, refuse: that is how an unreleased campaign ends up in an
image search.
5. Give every gallery an embargo date defaulting to "never public", and
refuse to build anything that promotes a gallery publicly without
checking it.
6. Gallery URLs are long random tokens, revocable in one action. Never a
client name, never a sequential id.
7. Contracts before the store: each signed one stored as an immutable PDF
plus hash and timestamp, readable without the app running.
8. Payments go through a hosted checkout. Write no code that can see a card
number and no table that could hold one.
9. Strip GPS from EXIF on downloads while keeping the copyright and creator
fields, and preserve ICC profiles through every resize.
10. Submit the contact form from outside my network on a schedule and alert
me when the message does not arrive.
11. Out of scope unless I ask: proofing, invoicing, tax, hosting anyone
else's portfolio. Finish by telling me what Format costs.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
The moment a single gallery holds work that is not yours to publish. Twenty-four dollars a month buys an access model that strangers have been poking at for fifteen years, and — more usefully — it buys the boring separation between the indexed half and the private half already being someone else's job. Build your own portfolio by all means; that part is genuinely a good weekend and you will end up with something better looking than the templates. Just do not let it grow a client-delivery feature, a contracts module and a checkout on three consecutive Sundays, which is exactly how this product gets built.
$24/mo is cheaper than your weekend.
The portfolio is the easy exit: keep the site in a static generator with the images in folders a human can read, and it moves to any host in an afternoon. The parts that do not move are the ones that matter. Contracts have to survive the application — export them as PDFs with hashes and a plain manifest of who signed what and when, because a contracts table with no renderer is not evidence of anything. Galleries need a delivery record: which client, which agreement, which embargo, so that whoever inherits this knows what must stay dark. And when you turn it off, the last act is not archiving the repo; it is confirming that every previously reachable private URL now returns 403 and that your old sitemap is gone from the index, because an abandoned gallery is still a gallery someone can find.
Self-hosted photo management with password-protected albums and share links, which is the client-gallery half already built by people who have made the access-control mistakes.
Open-source visual website builder for the portfolio half, if you want a builder rather than a static generator.
Questions
Carbonmade and Cargo are both DEMO ONLY. Why is this one a band worse?
Because those two are websites and this one is a business. Carbonmade's entry is about the image pipeline — colour, derivatives, bandwidth — and nothing in it can put you in breach of a contract. Format bundles client galleries holding work under embargo, contract generation and a store that takes money, and it puts all of that behind the same admin login as your homepage. The portfolio half of Format is genuinely a DEMO ONLY build. The tagline has three more halves.
How is this different from the Pixieset and Pic-Time entries?
Different harm. Pixieset's entry is about the gate failing on intimate photographs of individuals, and Pic-Time's is about what a gallery becomes over six years of storage bills and proofing records. This one is commercial: the images are somebody's unlaunched product, the injury is contractual rather than personal, and the leak vector is not a guessed URL but your own sitemap generator doing its job on a directory it should never have been able to see.
Is the embargo problem really a code problem?
It is a schema problem, which is worse, because you cannot patch your way out of it later. Every gallery app models privacy as a boolean: gated or not. Commercial work needs a third state — gated, and additionally not to be mentioned, thumbnailed, indexed or included in any 'recent work' feed until a specific date. If that date is not a column, the rule lives in your memory, and your memory is not what generates the sitemap at build time.
- GDPR Art. 5 — principles relating to processing of personal data (EU)
- GDPR Art. 32 — security of processing (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
The password gates the page. The JPEGs sit on a public bucket path, and Google does not need the password.
You are not delivering photographs. You are promising a URL still resolves on their tenth anniversary.
Nobody notices your layout. A photographer notices the second your resizer throws away the colour profile.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice