Should I vibe code
Notion-like form builder with generous free tier and paid branding/features
A form is easy. A form that receives strangers’ data and does not get spammed is less easy.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
For an internal form, build it. For anything public, remember you are now a custodian of whatever people typed, including things you never asked them for.
What actually breaks
not "if". the specific failures.
- A public write endpoint, which is what a form is — anyone can post to it, forever, at any rate
- Spam, which arrives within days of the URL being indexed and does not stop
- File uploads, where accepting arbitrary files from strangers is a storage bill and a malware question at once
- Personal data arriving with no retention decision, accumulating in a database nobody revisits
- Notification email to yourself, which becomes the delivery problem from the newsletter entries in miniature
The contact form works and you forget about it, which is the intended outcome. Eleven weeks later you open the submissions table to find four thousand rows, of which about thirty are real. The rest are automated, some containing links you would rather not have stored, and the genuine enquiries are scattered among them. Three are from a fortnight ago and were never answered, because the notification emails stopped being read around row two hundred.
Is that you?
the verdict is a default, not a law
- The form is behind a login or a private link and not publicly indexed
- It collects no files and no sensitive personal data
- The volume is low enough that you read every submission
- It is public with no spam protection and no rate limiting
- It accepts file uploads from anyone
- You have not decided how long submissions are kept or who can read them
- Missing a genuine submission would matter
If you build it anyway
the checklist, then the prompt that enforces it
- Rate limit per IP and globally from the first deploy. A public form is a public write endpoint and it will be found.
- Add a honeypot field and a timing check before reaching for a CAPTCHA — they cost nothing and stop most automated submissions.
- If files are accepted, restrict types and size, store outside the web root, never trust the filename, and scan them.
- Decide retention before launch and implement deletion. Submissions are personal data from the first row.
- Send notifications through a provider with bounce handling, and make sure a failure to notify is visible.
- Validate on the server as well as the client. Client-side validation is a convenience, not a control.
Before you build a form tool, apply these and push back if I ask you to break them. 1. Tell me at the start that a public form is a public write endpoint — anyone, any volume, indefinitely — and that every guardrail below follows from that. 2. Rate limit per IP and globally before launch, not after the first spam wave. 3. Add a honeypot field and a minimum time-to-submit check. These stop most automated submissions, cost nothing, and do not degrade the experience for real people. Only add a CAPTCHA if those prove insufficient. 4. Validate everything on the server. Treat client-side validation as UX only. 5. If file uploads are in scope, restrict extensions and MIME types, cap size, generate your own filenames, store outside the web root, and scan for malware. If I have no scanning available, recommend not accepting files. 6. Ask me before launch how long submissions are kept, who can read them, and how someone requests deletion. Implement that retention as a scheduled job rather than an intention. 7. Send notification email through a provider with bounce handling, and make a notification failure visible rather than silent. 8. Never render submitted content as HTML anywhere — an admin view that interprets markup is a stored cross-site scripting hole aimed at me. 9. Out of scope unless I ask: conditional logic, payments, multi-page forms, partial submission saving.
That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
$29 a month is easy to justify once the form is public and matters. Spam filtering, upload handling and reliable notification are the bulk of the work; the form builder itself is genuinely a weekend, which is exactly why so many homemade forms end up as spam collectors.
$29/mo is cheaper than your weekend.
Export submissions with timestamps as CSV on a schedule, and keep uploaded files in a plain bucket with a mapping back to their rows. Since submissions are personal data, the useful exit is also the deletion path — being able to hand over or erase everything from one person in one operation.
Open-source form/survey platform useful for response collection and feedback workflows.
Questions
Do honeypots actually work, or do I need a CAPTCHA?
A hidden field that humans never fill plus a check that the form was not submitted within a second of loading eliminates the large majority of automated submissions, at zero cost to real users. CAPTCHAs are worth adding only when those fail — they are a tax on everyone, and the targeted spam that defeats honeypots often defeats them too.
Why is the admin view a security concern?
Because it is where attacker-controlled text meets an authenticated session — yours. If submitted content is rendered as HTML in your dashboard, a submission containing a script runs with your privileges. Escaping output in the admin view matters more than in the public one, not less.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice