Should I vibe code
Send newsletters, build forms, and run a small welcome sequence
The unsubscribe link is the regulated part, and it is the part you will implement last.
?
Their verdict, the Growing Business price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
A welcome sequence is a state machine you can write in a day. Commercial email law, list hygiene and complaint feedback loops are not, and they are what stops your mail landing in spam.
What actually breaks
not "if". the specific failures.
- An unsubscribe link that 404s after you change your URL structure, turning every future send into a violation
- Unsubscribes written to a table the send job reads only when the batch is assembled, so the next issue goes out anyway
- A noreply From address, so the person who cannot unsubscribe cannot tell you either — they mark it spam instead
- A signup form with no double opt-in, quietly collecting typo'd addresses that belong to other people
- The physical postal address that CAN-SPAM requires and no template ever has
You moved the site to a new framework and the routes changed. Nobody complained, because the only person who visits /unsubscribe is someone who has already decided they are done with you — and they do not write to say the link is broken. They click, get a 404, and click Report Spam instead, because that button always works. Six sends later a reader forwards you the message from their provider explaining why your domain is now filtered, and you discover the link has been dead since March.
Is that you?
the verdict is a default, not a law
- It is a few hundred people who typed their address into your form and confirmed it
- A provider's API does the sending and you built the editor and the archive
- You would notice within a day if sends stopped arriving
- The unsubscribe path is not the first thing you built and the first thing you test
- Suppression is checked when a batch is built rather than as each message is sent
- The From address cannot receive replies
- You cannot produce, for any subscriber, the moment and source of their consent
If you build it anyway
the checklist, then the prompt that enforces it
- Build unsubscribe before send. One click from the email, no login, no confirmation step, honored immediately and permanently.
- Add List-Unsubscribe and List-Unsubscribe-Post headers so the provider's own one-click button works, not just your link.
- Add a test that fetches the unsubscribe URL of a real send and asserts 200. Run it on every deploy — this is the check that catches the route change.
- Check suppression per recipient at send time, inside the loop, never at batch assembly.
- Double opt-in on every signup form, and store timestamp, source and IP as the consent record.
- A real reply-to and the postal address CAN-SPAM requires in the footer of every commercial message.
Before you write any code for a newsletter tool, apply these and push back if I ask you to break them.
1. Build unsubscribe before you build send. One click from the email, no login,
no 'are you sure', honored immediately and permanently. If I ask you to do
it later, refuse and explain that it is the legally required part.
2. Add List-Unsubscribe and List-Unsubscribe-Post headers to every commercial
message so the mailbox provider's own unsubscribe button works. Many people
will use that instead of your link, and if it is absent they use Report Spam.
3. Write an automated test that takes the unsubscribe URL out of a rendered
send, fetches it, and asserts a 200 and a recorded opt-out. Wire it into the
deploy. Tell me this is the test that catches a route change silently
breaking the link.
4. Check the suppression list per recipient inside the send loop, at the moment
of sending. Never filter once while assembling a batch.
5. Every signup uses double opt-in. Store the confirmation timestamp, source
and IP as the consent record. Reject any subscriber creation without them.
6. The From address must accept replies and route somewhere a human reads. No
noreply@ addresses.
7. Put a real physical postal address in the footer of every commercial
message, because CAN-SPAM requires one. Ask me for it rather than inventing
a placeholder.
8. Send through a provider API. Configure SPF, DKIM and DMARC, and verify DKIM
alignment with the From domain.
9. Suppress permanently on hard bounce and on complaint, tracked per address
across all campaigns.
10. In the README, say that the unsubscribe path is the regulated surface, that
it fails silently, and that $10 a month buys a version somebody else tests.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
At $10 a month this is the cheapest insurance on the list. You are not paying for the editor, which you could write this weekend. You are paying for an unsubscribe path, consent records and suppression that someone else keeps working while you are busy writing the actual newsletter.
$10/mo is cheaper than your weekend.
Export subscribers with their consent records and opt-out status as CSV from day one. The opt-out list is the part you must carry to any new system intact — re-mailing someone who unsubscribed because the export dropped a column is the one migration mistake with a statutory penalty attached.
Mature open-source newsletter and mailing-list manager.
Questions
How fast does an unsubscribe actually have to be honored?
CAN-SPAM allows up to ten business days in the US, but that is a ceiling written for an era of manual list management, not a target. GDPR expects withdrawal of consent to be as easy as giving it. Practically, honor it inside the same send — the person who clicked has already decided, and a delay is what produces the spam complaint.
Is double opt-in really necessary for a small list?
It is the cheapest protection you have. Without it a single typo puts a stranger's address on your list, and that stranger's spam complaint is judged against your domain. It also gives you the timestamped consent record you would otherwise have no way to produce.
- CAN-SPAM Act: A Compliance Guide for Business (FTC)
- GDPR Art. 7 — conditions for consent (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Small list, same law. The compliance floor does not scale down with your subscriber count.
Sending bulk email is 5% code and 95% not getting your domain blacklisted forever.
Your reputation as a sender is an asset you can destroy in one bad loop and never rebuild.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice