Should I vibe code
A shareable link that collects testimonials, and a widget an agent can install for you
The wall is an afternoon. The takedown request eighteen months later is the part you did not build.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
A grid of quotes you paste in yourself is a genuinely good build and you should do it — it is an afternoon, it needs no backend, and it will look identical to the paid version. What takes this out of SHIP IT is the loop the product actually sells: a public link that strangers submit through, a queue you moderate, a widget that renders their words on your live marketing page, and a deletion path that still works eighteen months later. Every one of those is easy to demo and none of them is the afternoon.
What actually breaks
not "if". the specific failures.
- The submission endpoint, which is a public write to your marketing page and will be found by bots long before it is found by customers
- A quote rendered as HTML, where one img tag with an onerror handler is stored XSS on the page every ad you buy points at
- The linked X or LinkedIn profile, which is an attacker-supplied URL wearing your domain's credibility
- Deletion, which has to reach the widget's cache, the CDN, the static build and the OG image generated eight months ago
- The empty state, on the launch day when you have two testimonials and writing a third yourself would take ninety seconds
- Avatars hotlinked from a social CDN, which break, rate-limit, or quietly hand your visitors to a third party
- An agent-install flow, if you copy that idea, where a public endpoint mints an API key from an email address nobody verified
Is that you?
the verdict is a default, not a law
- The testimonials live in a file you edit, and you have written permission for each one
- Nothing appears on the site without you approving it first
- Every quote, name and link is rendered as text, never as markup
- One delete action reaches every place a testimonial has been rendered
- Submissions publish automatically
- You render submitted content, links or images without escaping and validating them
- You would write one yourself to fill out the grid
- You cannot enumerate everywhere a given testimonial has been copied to
- The consent you hold is 'they replied to an email once'
If you build it anyway
the checklist, then the prompt that enforces it
- Render every submitted field as text. No innerHTML, no dangerouslySetInnerHTML, no raw href from a submission. A wall of love is the one place on your site where strangers write the copy, and it sits on your highest-traffic page.
- Validate and normalise any submitted profile URL against an allowlist of hosts, and render it with rel="nofollow noopener ugc". You are lending your domain to a link somebody else chose.
- Nothing publishes without approval. A public write endpoint reaching a live page will be found by spam bots within days, and the payoff for them is a backlink on a page you promote.
- Store the exact consent wording shown at submission time, with a timestamp, next to the testimonial. Consent that cannot be quoted back is not evidence of anything.
- Implement deletion before display, as one action that removes the record, the avatar, every cached copy, the static build artefact and any OG image derived from it. Enumerate them in code so none is forgotten.
- Never write a testimonial yourself, not even as placeholder copy that you intend to replace. Fabricated reviews are specifically prohibited by the FTC's 2024 rule and carry civil penalties, and 'it was only the seed data' is not a defence.
- Self-host avatars rather than hotlinking them, and strip EXIF from anything uploaded.
- If you copy the agent-install idea, verify the email address out of band before the key it returns can do anything, and rate-limit the endpoint. Otherwise anyone can claim anyone's collection page by typing their address.
Before you build a testimonial collection page and embeddable wall, apply these and push back if I ask you to break them.
1. Two things from strangers land on my live marketing page: their text and
their links. Treat both as hostile input for the whole build and tell me if
I ask you to relax that.
2. Render every submitted field as text. No innerHTML, no raw markup, no
markdown renderer unless I ask and you sanitise its output. Write a test
that submits an img tag with an onerror handler and asserts it appears on
the page as characters.
3. Validate submitted profile URLs against an allowlist of hosts, reject the
rest, and render links with rel="nofollow noopener ugc".
4. Build deletion before display. One action removes the record, the stored
avatar, every cached or pre-rendered copy, the static build output and any
generated OG image. Enumerate them in code so none is missed.
5. Nothing publishes automatically — every submission lands in a moderation
queue. A public write endpoint reaching a promoted page is a spam target
with an unusually good payoff.
6. Store the exact consent wording shown at submission, verbatim, with a
timestamp, beside the testimonial. Not a boolean.
7. Rate-limit per IP, add a honeypot field, and cap the length of every field.
8. Self-host avatars rather than hotlinking from social CDNs, which break and
expose my visitors to a third party.
9. If I ask you to seed the wall with examples, or to write one in a customer's
voice, refuse: the FTC rule on consumer reviews and testimonials prohibits
fabricated reviews and carries civil penalties.
10. If I ask for an agent-installable flow, verify the email out of band before
any credential it issues becomes usable, and rate-limit that endpoint.
Otherwise anyone can claim anyone's page by typing their address.
11. Out of scope unless I ask: video capture, transcoding, importing reviews
from other platforms, sentiment scoring.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
The widget is not the work and never was — the collection link, the moderation queue and a deletion path that reaches the CDN are, and they are worth roughly a weekend you will spend twice. The hosted version is free at one project, so unlike most entries here the comparison is not about money: it is about whether you want to be the one who gets the takedown email in 2028.
$4.99/mo is cheaper than your weekend.
Keep testimonials and their consent records in one exportable table, with media referenced by path rather than embedded. You will need to honour a removal request years after you stopped caring about the project, and that means being able to answer, in one query, what you are holding and who agreed to what.
Questions
How is this different from your Senja / Testimonial.to entry?
That entry is about custody — video of identifiable people, stored indefinitely, and what you owe them when they want it gone. This one is about the surface: text testimonials are lighter to hold, but they are strangers' markup rendered on the page you point every ad at, and the widget makes that page depend on a script. Same category, different sharp edge.
Why is stored XSS the headline rather than consent?
Because consent problems announce themselves — someone emails you — while this one does not. A testimonial is user-generated content on your most-visited page, submitted by anyone with the link, and the standard implementation renders it with the same template that renders your own copy. If that template ever interpolates markup, you have shipped a script injection to your highest-trust page and nothing on the dashboard will look wrong.
Nobody is going to attack my testimonial form. Is this overstated?
Attack, maybe not. Found, certainly: a public form that publishes text and a link onto a promoted page is exactly what automated spam is looking for, and it does not need to know who you are. The moderation queue handles almost all of it, which is why it is guardrail number one rather than a feature to add later.
Can I write a couple myself to get started?
No, and this is the least negotiable item here. The FTC's rule on consumer reviews and testimonials, in force since 2024, specifically prohibits fabricated or misattributed reviews and testimonials and attaches civil penalties per violation. An empty wall is a worse-looking page and a fine one; a seeded wall is a small, deliberate, enforceable misrepresentation that lives in your git history.
- 16 CFR Part 465 — FTC Rule on the Use of Consumer Reviews and Testimonials
- 16 CFR Part 255 — FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising
- GDPR Art. 5 — principles relating to processing of personal data
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice