Should I vibe code
Self-host a feed reader with training filters, folders, and full-text search
RSS is a fetch loop with a read flag. The only real work is not being rude to the servers you're polling.
?
Their verdict, the Premium price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
A reader is a fetch loop, a parser and one boolean per item, and it is one of the few products on this list where the homemade version is straightforwardly better: your keyboard shortcuts, no ranking, no suggested content, a feed list nobody is optimising. Two things separate a polite reader from a rude one and neither is difficult. Send conditional requests, so you are not pulling a one-person blog's entire feed every five minutes for the rest of the decade. And treat feed HTML as hostile before anything renders it, because it is arbitrary markup written by strangers arriving inside your browser session. Do those and the worst outcome is that you stop reading for a month. Note that NewsBlur is itself open source, so "build it" has two readings — writing a small one is an evening, and running theirs is Django plus Postgres plus MongoDB plus Redis plus Elasticsearch, which is not.
What actually breaks
not "if". the specific failures.
- Politeness: no ETag, no If-Modified-Since, a flat sixty-second poll, and you are a small denial-of-service against people publishing for free
- Feed HTML, which is untrusted markup from strangers and will carry a script tag straight into whatever renders it
- Encodings and malformed XML, which are most of the actual work in a feed parser and none of the fun
- GUID churn, where a feed republishes every item as new on every fetch and your unread count becomes meaningless
- Summary-only feeds, which is why full-text extraction exists, and why it is the second project rather than a flag
- The training classifier — the thing NewsBlur is actually selling — which needs labelled examples you will never produce in useful quantity
- Sites dropping RSS altogether, at which point your reader needs scrapers and the maintenance shape changes entirely
- Your own IP, once a datacentre box starts hammering a thousand feeds and Cloudflare starts answering for them
Is that you?
the verdict is a default, not a law
- It reads your feeds on your machine and writes nowhere else
- Requests are conditional and rate-limited, with a User-Agent that says who you are and how to reach you
- Feed HTML is sanitised through a real allowlist before anything renders it
- OPML import and export both work on day one, so leaving is never a project
- You are hosting it for other people, which turns a fetch loop into a service with accounts and someone else's uptime
- Feed HTML is rendered unsanitised in a page that also holds a session cookie
- You intend to poll thousands of feeds every minute and then wonder why publishers blocked you
- You are hoping to reproduce the intelligence training, which is the one part that needs data you do not have
If you build it anyway
the checklist, then the prompt that enforces it
- Send conditional requests. Store ETag and Last-Modified per feed, honour 304, and back off on 429 and 5xx. This is fifteen lines and it is the difference between a reader and a nuisance.
- Set a real User-Agent naming your project and a contact. Publishers who block anonymous pollers usually will not block someone they can email.
- Back off per feed on failure — exponential, capped, persisted — so a dead domain does not get retried every minute for two years.
- Sanitise feed HTML with an allowlist library before it goes anywhere near the DOM. Strip scripts, event handlers, iframes, and rewrite links to open safely.
- Do not proxy remote images by default, or every feed you subscribe to gets a read receipt with your IP on it.
- Key items on a stable identity — GUID where sane, hash of link plus title where not — and never on position, or a reordered feed marks everything unread.
- Support OPML in and out from the first commit. It is thirty lines, and it is the entire reason this category is safe to build.
I am building a personal RSS reader: fetch feeds, parse them, mark read, search. It is low risk, so keep it that way — do the polite and the safe parts before the interface, and push back if I want to skip them.
1. Start with the fetcher, not the UI. Implement conditional requests — store ETag and
Last-Modified per feed, send If-None-Match and If-Modified-Since, handle 304 as success.
2. Set a descriptive User-Agent with the project name and a contact URL, and explain why an
anonymous poller gets blocked and a named one usually does not.
3. Add per-feed exponential backoff with a cap, persisted across restarts, plus explicit
handling of 429 and Retry-After. A dead feed must not be retried every minute forever.
4. Default the poll interval to something a publisher would not mind, and derive it from the
feed's own observed update rate rather than a fixed number.
5. Before rendering anything, sanitise feed HTML through an allowlist library. No scripts, no
event handlers, no iframes, no inline styles. Say plainly that feed content is untrusted input.
6. Do not load remote images by default. Explain that each one is a read receipt sent to the
publisher with my IP on it, and make it a setting rather than a default.
7. Key items by GUID when it is stable, otherwise by a hash of link plus title. Never by
position in the document.
8. Implement OPML import and export before any feature work, and test a round trip. This is my
exit and it should exist from the first commit.
9. Store items in SQLite with the raw fetched XML kept for the last N revisions per feed, so
parser bugs are diagnosable rather than mysterious.
10. Assume malformed XML, wrong declared encodings and mixed Atom/RSS/JSON Feed. Write those
tests first; they are where the real work is.
11. Out of scope unless I ask again: accounts, multi-user hosting, and any scraping of sites
that do not publish a feed.
12. If I ask for NewsBlur's intelligence training, tell me it needs labelled data I will not
generate, and that $36 a year funds one of the last independent readers.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
You want the archive and the training rather than a reader. $36 a year is the cheapest thing on this site and it funds one of the very few independent readers left standing; the $99 Premium Archive tier keeps every story forever, which is the one feature your weekend version will not casually match. If you just want to read your feeds your own way, build it — or run FreshRSS or Miniflux and spend the weekend on something else.
$3/mo is cheaper than your weekend.
OPML out, and the item store as SQLite. Between them your subscriptions move to any reader in the world in one file, and your read/starred state moves in a query. Keep the raw fetched feed XML for recent revisions and even your archive is portable. There is genuinely no lock-in here unless you invent some.
Mature open-source RSS reader with feeds, filters, and self-hosting support.
Minimalist Go feed reader in a single binary; a good reference for polite fetching and a small item store.
NewsBlur's own source, self-hostable — but a Django, Postgres, MongoDB, Redis and Elasticsearch stack rather than an evening.
Questions
NewsBlur is already open source. Does that make this free?
It makes it available, which is not the same thing. Their stack runs Django alongside Postgres, MongoDB, Redis and Elasticsearch, and operating that for one reader is a hobby in its own right. The two sensible paths are writing a small reader — which is genuinely an evening and is what canivibecodeit is estimating — or running FreshRSS or Miniflux, which are built to be self-hosted by one person.
What is the one thing most homemade readers get wrong?
Conditional requests. Without ETag and If-Modified-Since you re-download every feed in full on every poll, forever, from servers run by people paying their own bandwidth bills. It is about fifteen lines. Skipping it is the only way a personal RSS reader manages to harm anybody, and it is why the guardrails here are mostly about manners rather than security.
Is rendering feed HTML actually risky in a personal app?
Yes, in the ordinary way. Feed content is arbitrary markup authored by strangers, delivered to your browser, in a page that probably shares an origin with everything else your reader can do. Run it through an allowlist sanitiser and the problem disappears. Leave remote images off by default too, or every publisher you follow gets a small notification, with your IP, every time you open an item.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice