Should I vibe code
Publish a clean branded lead form with routing, notifications, and exports
A broken form and an unpopular one produce identical data: none. You find out six weeks later, from a customer.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The form is the easy half and it genuinely is one sitting: a schema, some inputs, a POST, a row. What Reform sells sits on either side of that — getting each submission to somewhere a human will look, and stopping the endpoint filling with garbage — and both of those fail the same unhelpful way, which is quietly. A form that captures nothing looks exactly like a form nobody filled in. No error, no bounce, no red row anywhere; just a conversion graph you assume was always going to be flat. Meanwhile the endpoint is public by definition, so what you have built is not really a form, it is an unauthenticated write into your database that anyone on the internet may call as often as they like. Add the things Reform charges for — enrichment, abandoned-submission capture, CRM sync — and you are also holding data about people who never pressed submit and have never heard of you. None of it is exotic. It is just more duty of care than a weekend usually signs up for.
What actually breaks
not "if". the specific failures.
- The notification path, silently. SMTP credentials expire, the webhook starts returning 500s, Slack rotates a token — and because a form with no submissions looks like a form nobody used, nothing anywhere says the word "error"
- The public endpoint, on the day a bot finds it. Unauthenticated POST plus no rate limit gives you four thousand rows of casino spam and a notification inbox you stop reading, which is how the one real lead gets missed
- Deliverability of your own notifications: mail from a young domain, subject "New submission", body consisting of text a stranger typed. Spam filters have opinions about that shape
- The deletion request. Someone asks you to remove their data and an honest answer means knowing every place a submission travelled: the database, the CRM, the Slack channel, your inbox, and the CSV on your laptop
- Abandoned-submission capture, if you copy it. Storing what someone typed before deciding not to send it means holding data they actively withheld, which is a consent question rather than a feature flag
- Enrichment, the same problem from the other end: you now hold assertions about a person that they never typed and cannot correct
- The embed on somebody else's site — iframe height, CSP, cookie banners, and a form that works everywhere except the one customer page that matters
- Conditional routing, which starts as three ifs and becomes an untested rules engine that decides who gets replied to
Is that you?
the verdict is a default, not a law
- It is one internal form, behind a login, for people you could phone
- Submissions land in durable storage first and notification is a second, monitored step
- You collect a name and an email and nothing you would mind reading aloud
- There is a delete-by-email path and you have run it once
- It is the only route a customer has to reach you and nothing alerts when it goes quiet
- You are storing partial answers, enrichment, or anything the respondent did not knowingly submit
- It accepts file uploads, because the upload endpoint is exactly as public as the form is
- It collects health, financial or identity-document data — that is a different obligation and a different page on this site
If you build it anyway
the checklist, then the prompt that enforces it
- Write to durable storage before you notify anyone. The submission is either saved or it isn't; email is best-effort. Doing it the other way round loses leads to a timeout you never see.
- Alarm on absence, not just on errors. A daily "zero submissions received" alert is the only monitor that catches the failure this product actually has.
- Rate-limit at the edge and put a real challenge in front of the endpoint — Turnstile or hCaptcha plus a honeypot field. An open POST that writes rows is an invitation with your address on it.
- Collect the minimum, and write down per field why it exists and how long you keep it. GDPR Art. 5 is a checklist, not a mood.
- Escape on the way out as carefully as you validate on the way in. Submissions end up in HTML email, Slack messages and CSV exports, and each has its own injection story — including formula injection into whoever opens the spreadsheet.
- Build export and hard-delete-by-email on day one, while the schema is small enough that you can still find every copy.
- If you add uploads: private bucket, size cap, type allowlist, never served back from your own domain, and never with the original filename.
I am building a public lead-capture form: fields, validation, notification,
export. Two things matter more than the form. It must never silently stop
collecting, and it is an unauthenticated write endpoint on the open internet.
Build in this order and argue with me if I reorder it.
1. Persist first. The submission is written to the database and acknowledged
before any email, webhook or CRM call is attempted. Notifications are a
retryable side effect, never the primary store.
2. Build the monitor before the styling: a scheduled check that alerts me when
no submission has arrived in N hours, and a per-submission delivery log
showing attempted, succeeded, failed. Silence must be an alert condition.
3. Rate-limit per IP and globally, and add a bot challenge plus a honeypot
before the form goes public. Assume it will be scraped and replayed.
4. Ask me, field by field, why each exists and how long it is kept. Put the
answers in a retention table in the README and implement delete-by-email at
the same time as the schema.
5. Do not store partial or abandoned input unless I explicitly ask. If I do ask,
push back once: that is data the person chose not to submit, and its consent
story is different.
6. Escape output per destination. HTML email, Slack blocks and CSV each need
their own handling — prefix any CSV cell starting with =, +, - or @ so it
cannot execute in someone's spreadsheet.
7. Never render submitted content unescaped, on a public page or in the admin
view. The admin view is where stored XSS lands.
8. File uploads are out of scope unless I ask. If I ask: private bucket, size
limit, MIME allowlist, generated filenames, never served from my own origin.
9. CRM and SMTP secrets live in a secrets manager, not in the database holding
the submissions, and the form runtime should not be able to read both.
10. Give me a one-command export and a documented restore. If I later want the
parts Reform charges for, remind me that $35 a month includes somebody
noticing when submissions stop arriving.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
When the form is how strangers reach your business. Thirty-five dollars a month for Pro is a lot for input fields, and the free tiers elsewhere cover a hobby project — but what you are really buying at any price here is that somebody else's on-call rota notices when submissions stop arriving, plus a spam layer that has already met the bots. If the answer to "how would you know if this broke" is "a customer would tell me", pay someone.
$35/mo is cheaper than your weekend.
Cheap, if you keep the boundary clean. Submissions are rows; a CSV export gets you the data and any form builder will take it. The lock-in is not the data, it is the URL: every embed, every campaign link and every QR code points at a specific endpoint, so serve the form from a path on your own domain and proxy to whatever renders it. Then switching backends is a config change instead of a hunt through eighteen landing pages, an email footer and a printed card from last year.
Active open-source survey and experience-management platform, self-hostable with its own webhook and integration layer.
Questions
How is this different from the Typeform entry?
Typeform's risk comes from the conversational format — one question per page means you are holding answers from people who got to question nine and left. Reform's comes from what happens after submit: it is a lead pipeline, so the value is in the routing and the notification, and those are the parts that fail without telling anyone. Same band, different failure.
Is a form really a GDPR problem?
A form is the cleanest possible example of one, which is why it is worth getting right rather than worrying about. You are collecting identifiable data from people in the EU for a stated purpose; Art. 5 asks you to hold only what you need, for only as long as you need it, and Art. 32 asks you to secure it. The practical version is three things: a retention rule per field, a working delete path, and not copying the data into four systems you will forget about.
What is the single most common way the homemade version fails?
The SMTP password expires. Nothing else changes: the form renders, the POST returns 200, the row is written if you were sensible or dropped if you were not, and no email arrives. Because nobody alerts on the absence of good news, this typically runs for weeks. Build the "no submissions in N hours" alert before you build the theme.
- GDPR Art. 5 — principles relating to processing of personal data (EU)
- GDPR Art. 32 — security of processing (EU)
- GDPR Art. 7 — conditions for consent (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Survey answers are other people’s opinions with their identity attached. Store them like it.
You never decided to store health data. A dropdown someone added to an event signup decided it for you.
A total computed in the browser is a discount code for anyone who can open devtools.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice