Should I vibe code
Offer common PDF transformations through a private self-hosted interface
The best reason to self-host PDF tools: your documents stop being uploaded to strangers.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Merge, split, compress and convert are all mature libraries. Running them locally is both easier than it looks and materially better for anything confidential.
What actually breaks
not "if". the specific failures.
- Malformed PDFs, which are common and which crash or hang a parser that assumes the specification is followed
- Memory on large documents, where a naive merge loads everything and a 400-page scan takes the process with it
- Uploaded files sitting on disk after processing, which is the exact problem self-hosting was meant to solve
- A public instance, which is a service that accepts arbitrary binary files from strangers
- Compression that rasterises text, producing a smaller file nobody can search or copy from
The stakes are low and the irony is the point: you self-host so documents stop being uploaded to strangers, and then the temporary directory fills up with everyone's files because cleanup was a follow-up task. Months of contracts, invoices and scanned passports sit in /tmp on a box you set up in an afternoon. Nothing leaked. You simply rebuilt, on your own hardware, the thing you were trying to avoid.
Is that you?
the verdict is a default, not a law
- Files are deleted immediately after processing and cleanup is verified
- It is local or on a private network, not a public service
- Processing runs in a subprocess with memory and time limits
- Uploaded files persist after the response is returned
- It is publicly reachable and accepts files from anyone
- Parsing runs in the main process with no resource limits
- Compression rasterises text without saying so
If you build it anyway
the checklist, then the prompt that enforces it
- Delete input and output immediately after the response, and add a sweeper for what the happy path missed. This is the entire reason for self-hosting.
- Keep it private. A public PDF tool accepts arbitrary binaries from strangers, which is a different project with a different threat model.
- Process in a subprocess with hard memory and wall-clock limits, because malformed PDFs hang and huge ones exhaust memory.
- Stream page operations rather than loading whole documents, so merging large files is bounded.
- Never rasterise text during compression without saying so — a smaller unsearchable file is usually a worse file.
- Strip metadata on output, and remember that redaction is a different operation entirely.
Before you build self-hosted PDF tools, apply these and push back if I ask you to break them.
1. Delete uploaded and generated files immediately after the response is sent,
and add a scheduled sweep of the working directory for anything the normal
path missed. Tell me that leaving files behind recreates exactly the problem
self-hosting was meant to solve.
2. Keep this on localhost or a private network. If I want it publicly
reachable, tell me it becomes a service accepting arbitrary binary files
from strangers, and that this needs authentication, rate limiting and size
caps before anything else.
3. Run all parsing and processing in a subprocess with hard memory and
wall-clock limits. Malformed PDFs are common and will hang or exhaust a
process that assumes the specification is followed.
4. Stream page-level operations rather than loading entire documents, so
merging large scans has bounded memory.
5. Use a mature PDF library. Do not parse the format yourself.
6. For compression, never rasterise text without telling me. A smaller file
that cannot be searched or copied from is usually worse than the original.
7. Strip metadata from output files.
8. If I ask for redaction, tell me that is a different operation which must
remove underlying content, and that drawing a box over text does not do it.
9. Validate that uploads are actually PDFs rather than trusting the extension.
10. Out of scope unless I ask: OCR, e-signatures, encryption, format
conversion.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
$12 a month buys convenience and broad format support. The reason to build this is exactly the one in the hot take — your documents stop being uploaded to strangers — which only holds if you delete the files, so treat cleanup as the feature rather than the housekeeping.
There is nothing to keep — files go in, files come out, and both should be gone shortly afterwards. That is the design goal rather than a limitation, and the measure of success is that the machine holds nothing a week later.
Active open-source web application for a broad set of PDF operations.
Questions
Why is cleanup the headline guardrail rather than an implementation detail?
Because it is the entire justification for the project. Self-hosting PDF tools is worthwhile precisely so that contracts and scans do not sit on someone else's server — and a temporary directory that never empties reproduces that on hardware you now also have to secure. The feature is the deletion, not the conversion.
How does this relate to the PDF Expert entry?
That entry covers editing and, critically, redaction — where drawing a black box leaves the text underneath selectable. This one covers the transformation utilities: merge, split, compress. Different operations, and worth keeping separate, because redaction is the one that has caused real disclosures and it is not a transformation.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice