Should I vibe code
A form, an embed widget, and a wall page
You are collecting real people’s faces and words to display in public. Get that consent in writing.
?
Their verdict, the price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
A form, a storage bucket and an embed script is a very reachable build. The obligation you take on is other people’s likenesses on your infrastructure, including when they later want them gone.
What actually breaks
not "if". the specific failures.
- Video and photos of identifiable people, stored indefinitely
- A testimonial displayed after the person asked for it to come down
- Fake submissions from a public form nobody is moderating
- Storage costs quietly growing forever
Someone emails asking you to remove their testimonial. They left the company and would rather not be endorsing you any more. You find the text on the site easily enough, then discover the video is also in a CDN cache, in a marketing deck, and in the OG image you generated at build time eight months ago.
Is that you?
the verdict is a default, not a law
- You have explicit written consent to publish, with the scope spelled out
- Removal is one action that reaches every copy
- Submissions are moderated before they appear
- Submissions publish automatically
- You cannot enumerate everywhere a given testimonial has been copied to
If you build it anyway
the checklist, then the prompt that enforces it
- Consent checkbox with specific wording, stored with a timestamp alongside the submission.
- Nothing publishes without approval. A public write endpoint will be found by bots.
- One delete action must remove every derived artefact — thumbnails, caches, generated images.
- Rate-limit and add a honeypot on the form.
- Strip EXIF from uploads; photos carry location data.
I am building a testimonial collection and display widget. I will be holding other people's faces and words, so: 1. The submission form has an explicit consent checkbox with specific wording about where the testimonial may appear. Store the exact consent text shown, plus a timestamp, alongside every submission. 2. Nothing is published automatically. Every submission lands in a moderation queue. A public endpoint that writes straight to a live page will be found by spam bots within days. 3. Implement deletion before display. One 'delete' action must remove the record, the original media, every generated thumbnail, any cached or pre-rendered copy, and any OG image derived from it. Enumerate these in code so none is forgotten. 4. Strip EXIF metadata from all uploaded images on receipt — photos routinely carry GPS coordinates. 5. Validate uploads by content, not extension. Cap file size and dimensions. 6. Rate-limit submissions per IP and add a honeypot field. 7. Serve media from a path that is not guessable by enumeration. 8. Write a README section on what I owe the people who submit: the ability to see, correct and remove what I hold about them.
That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
If you are collecting video from customers at any volume, the hosting, transcoding and takedown workflow is most of the cost, and $25 a month is a reasonable price for someone else owning it.
$25/mo is cheaper than your weekend.
Keep testimonials and their consent records in one exportable table with media referenced by path. If the project ends, you need to be able to honour a removal request years later, and that means knowing what you have.
Questions
It is just a form and an embed script. Where is the risk?
In the durability. The form is an afternoon; being a responsible custodian of identifiable people’s video for as long as it is on your site is the actual commitment, and it outlasts your interest in the project.
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice