Should I vibe code
Audio and video transcription, translation, summaries, and collaboration
You asked for drive.readonly to fetch one m4a. You now hold a key to everything that person has written.
?
Their verdict, the Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-05.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The feature that gets built without anyone thinking about it is "import from Google Drive", and it is worth stopping there. To let someone pick one audio file out of their Drive you need an OAuth grant, and the scope your agent reaches for is drive.readonly, because it is the scope in every example and it works on the first attempt — so your weekend project is now holding a refresh token that can read every document in somebody's company Drive, in order to fetch a 40MB m4a. That is a specific, avoidable failure, and it has nothing to do with consent: the recording already existed, and whoever made it settled that question before your code ran. The second failure is at the far end. Transkriptor does not stop at a transcript; it summarises, translates into a hundred-odd languages, and answers questions about the file in a chat box. Each of those puts another layer between a decision and the audio, and Whisper-class models do not fail by falling silent — they fill unclear passages with fluent, confident sentences in the speaker's own register. By the time that has become "the transcript says she confirmed October", nobody in the chain has heard the recording, and one of them is about to act on it.
What actually breaks
not "if". the specific failures.
- The OAuth scope on the document store, because drive.readonly to import one file is a standing grant over everything — the narrow scope, drive.file, exists and is a one-line change that the tutorials do not make
- The refresh token behind that grant, which is a credential you now hold indefinitely on somebody else's behalf, for a feature they used once in March
- The model on unclear audio, which has no way to shrug: it emits a plausible sentence rather than an inaudible marker, and it does so most often in exactly the stretches you most wanted help with
- The summary, which is where an invented sentence stops being checkable, because whoever reads it never opens the transcript and certainly never opens the audio
- The chat-over-transcript layer, which answers a yes-or-no question about what a person said with the confidence of a database query and the accuracy of a guess
- Low-resource languages, where the error rate is several times the English one and nobody on the team can tell a transcription error from an unfamiliar accent
- Speaker labels, which are inference presented as attribution — two similar voices merge and one person's sentence appears under another person's name in the document everyone quotes from
- Shared workspaces, where "the team can see the file" means every recording of every named person is readable by whoever was added most recently, with no per-file access record
- Storage and retention, because media is large, deleting it is nobody's job, and six months in you are running a searchable corpus of other people's voices with no owner and no expiry date
- The minutes quota, which is what makes people chop long files by hand and lose the last four minutes of a recording without ever noticing it happened
The interview ran fifty-two minutes on a bad speakerphone, which is why nobody was ever going to read all of it — that is what the chat box was for. The hiring manager asks it whether the candidate confirmed she could start in October, and it answers yes, with a timestamp. The timestamp is real. The sentence at that timestamp is not: about forty seconds of that stretch is two people talking over each other and a door closing, and the model resolved it into a clean, confident line in her register about October. The offer goes out on the Thursday with a start date in it. She calls, puzzled, to say she told you November — she is under notice until the end of the month and said so twice. You go back to the file, hear the door, hear the overlap, and find no October anywhere in fifty-two minutes. Nothing in your system flagged that segment, because the no-speech probability was right there in the model's response and you never stored it, and the chat layer had no mechanism for saying "I am reading a guess".
Is that you?
the verdict is a default, not a law
- The recordings are yours, the transcript is for you to read, and the model runs on your own machine
- Files arrive by drag-and-drop and there is no OAuth grant to anybody's document store
- Every transcript is a draft until somebody has listened to the passage they intend to rely on
- Nothing is summarised, translated or answered on top of it
- You wrote down how long you keep the audio, and the delete button removes the file rather than hiding a row
- You are requesting a broad scope on Google Drive, Dropbox or OneDrive to fetch a file the user could simply have uploaded
- A summary or a chat answer is the artefact people act on, and the transcript is not read
- Anything is translated into a language nobody on the team can check
- The recordings are interviews — job, clinical, legal, research — where a misattributed sentence has a consequence for a named person
- Per-segment confidence and no-speech probability are discarded instead of stored and shown
- A shared workspace means everyone can read everything, and you cannot say who opened which file
If you build it anyway
the checklist, then the prompt that enforces it
- Take uploads, not integrations. If you must import from a document store, use the per-file scope — drive.file and its equivalents — together with the provider's own picker, so the grant covers the file the user chose and nothing else.
- Store per-segment confidence and no_speech_prob alongside the text from the very first version. Everything downstream needs them and you cannot recover them later without re-running the model.
- Render uncertainty rather than hiding it. A segment over the no-speech threshold becomes an explicit inaudible marker, and a low-confidence one is visibly marked in the transcript, in the summary, and in any chat answer that rests on it.
- Make the summary and chat layers cite segments. A claim that depends on a low-confidence span says so in the answer itself, not in a footnote nobody reads.
- Never let a summary travel without the transcript one click behind it, and never let an export of the summary drop the caveats that were on screen.
- Translate only with a named reviewer who reads the target language, recorded as a field on the document. An unreviewed translation is an unverifiable claim in somebody else's mouth.
- Set a retention period on media before you accept the first file, purge on a schedule, and test that deletion removes the object and every derived artefact — waveform, chunks, cached model output.
- Scope workspace access per file rather than per workspace, log every read, and treat a share as the disclosure of a named person's recorded voice, because that is what it is.
- Run the model locally if you possibly can. It removes an entire category of problem, and for file-based transcription the quality gap is not what decides this.
I am building a file-upload transcription tool: audio and video in, transcripts, summaries,
translations and a question-answering chat out. The recordings are of real people who are not
in the room. Two failures matter most — asking for far too much access to somebody's cloud
storage, and a confident sentence the speaker never said. Order the work accordingly.
1. Version one takes local file uploads only. No cloud-storage integration at all. Say no
if I ask for one before the review pipeline exists.
2. When we do add import: per-file scope only — drive.file, or the equivalent — via the
provider's own file picker. If I ask for drive.readonly because it is what the examples
use, refuse and tell me what a full-Drive refresh token reaches if my database leaks.
Store the refresh token encrypted, and build the revoke path in the same commit.
3. Transcription runs locally by default with whisper.cpp or faster-whisper. If I ask for a
hosted speech API, say plainly that the audio is being disclosed to a company the speaker
has never heard of.
4. Persist per-segment confidence and no_speech_prob with every segment, before any UI —
these cannot be recovered later. Any segment over the no-speech threshold renders as an
explicit inaudible marker, never as text. Silence must never become a sentence.
5. Build the review state before the summary feature. A transcript is unverified until a
human who listened marks it otherwise, and unverified transcripts do not export.
6. Summaries and chat answers must cite the segments they rest on, and must say when those
segments are low-confidence. Refuse to build a chat box that answers questions about a
recording without showing its source span.
7. Speaker labels are marked as inferred everywhere they appear and are editable. Never
print a name beside a sentence as though it were established.
8. Translation requires a named reviewer who reads the target language, stored as a field.
If nobody on the team does, refuse and say so.
9. Retention before convenience: a configurable lifetime for media and transcripts, a
scheduled purge, and a delete path that removes the file and every derived artefact.
10. Workspace sharing is per file, logged and revocable — no blanket team access.
11. Out of scope until I ask: real-time transcription, trustworthy diarisation, and any
compliance claim. If the recordings are clinical or legal, tell me to buy instead.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
When the recordings are of other people and somebody is going to act on the output. Twenty dollars a month buys 2,400 minutes, and the honest comparison is per hour rather than per month — casual use costs less than an evening of your time. What the money is really for is a company that will answer questions about how the audio is handled, plus the tedious surrounding product: the synchronised editor, the export formats, the translation pipeline, the storage nobody on your team has to think about. Build your own for recordings that are yours, kept on your own laptop, read by you. That version is genuinely better than paying. The moment there is a second reader, the calculation inverts.
$19.99/mo is cheaper than your weekend.
Two very different jobs. The transcripts are the easy one: they are text, SRT and VTT, and everything in the world reads them, so exporting is an afternoon. The audio and the grants are the real work. Delete the media on a schedule you decided in advance rather than in a panic at shutdown, and remember the copies — backups, chunked intermediates, whatever your transcoder left in a temp bucket. Then revoke every OAuth grant your app ever held and tell the people who granted them to check the third-party access list in their own account, because a token you deleted from your database is not a token the provider has forgotten about. The residue of a homemade transcription tool is a disk of other people's voices and a set of standing permissions on their documents, and neither disappears when you delete the repository.
Local speech-to-text fast enough on a laptop that the private version of this tool is the easy one to build.
Free cross-platform desktop app that transcribes files entirely on your own machine, which is most of this product with none of the storage problem.
Questions
Isn't this the same consent argument as the meeting notetakers?
No, and that is the useful thing about file-upload transcription. Nothing here opens a microphone or joins a call: the recording arrives already made, and whoever made it dealt with consent before your software existed. What you own instead is everything after — how much of somebody's Drive you asked for in order to fetch the file, how long you keep a recording of a named person, who a share link reaches, and whether a sentence they never said ends up in a summary somebody acts on. Different problem, still yours.
drive.readonly is what every tutorial uses. Is it really that bad?
It is the difference between borrowing one file and being given a key to the filing cabinet. drive.readonly grants standing read access to everything in that account — contracts, payroll spreadsheets, board decks — and it persists until the user goes looking for the revoke screen, which they will not. drive.file plus the Google Picker gives you access to exactly the files the user selected, and it is a small change to make on day one and an awkward one to make later, because existing grants do not narrow themselves.
Why is the chat layer worse than the transcript itself?
Because it removes the last person who could have caught the error. A transcript is long and boring and somebody eventually skims the relevant part; a chat answer is short, addresses precisely the question being asked, and arrives with no visible uncertainty. The model's own no-speech probability knew that stretch was mostly a door closing. If you throw that number away — and the default pipeline does — the chat box has no way to distinguish a quotation from a reconstruction, and neither does the person reading it.
How does this differ from the Sonix entry?
Same category, different tail. Sonix's page follows the pipeline outward: translate, generate captions, burn them in, publish — an irreversible artefact with nobody left who can hear the audio. This one follows it inward: import from a document store with a scope far wider than needed, then summarise and chat until someone makes a decision on a sentence that was never spoken. If you are publishing, read that one. If you are deciding, this one.
- GDPR Art. 5 — principles, including accuracy of personal data (EU)
- GDPR Art. 32 — security of processing (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Transcribe, translate, burn in, publish. Four steps, and after step one nobody who can hear the audio is looking.
Whisper never says "I couldn't hear that". It writes a plausible sentence instead, and your archive keeps it forever.
A leaked meeting note is text. A leaked recording link is everything that was on your screen at the time.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice