Should I vibe code
Capture screen, GIF, or screenshot and create a shareable hosted link
The upload happens before you look at the screenshot. That is the product, and that is the bug.
?
Their verdict, the Create price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Names first: Zight is CloudApp, renamed in April 2023, and it is thoroughly alive — the current plan page sells HIPAA compliance, SSO and an MCP server, which tells you plainly what people put into these things. CleanShot X is a SHIP IT on this site because it stops at your disk. Zight's product is the ten seconds after that: one keystroke captures, uploads, and puts a public URL on your clipboard, and the reason it feels like magic is that no human reads the frame in between. Rebuild that faithfully and you have automated publishing. What gets published is whatever happened to be on screen — the customer's email address in the CRM tab, the bearer token in your terminal scrollback, the DM in the window behind — and it lands somewhere with no expiry, no password and no access log, because those are the three features you were planning to add in week three. Then the link goes into a support ticket, a Jira comment, a public forum thread, and it stops being yours: the unfurl keeps a thumbnail, the recipient keeps the URL, the crawler keeps a copy, and deleting the object is not the same thing as un-sharing it. Meanwhile you have quietly promised uptime to every link you have ever pasted, and taken on an egress bill with no ceiling. A one-sitting build with a permanent obligation attached is exactly the shape this site exists to flag.
What actually breaks
not "if". the specific failures.
- The review step, which does not exist — the upload has finished before you have looked at what you captured
- Link expiry, which is nobody's week-one feature, so every capture you have ever taken is live indefinitely
- Object keys built from a timestamp or a counter, which turn one shared link into a directory listing of your entire capture history
- The frame itself: terminal scrollback, notification toasts, a second monitor, the tab you forgot was open
- Deletion, which removes the object but not the Slack unfurl thumbnail, the crawler's copy or the recipient's cached image
- Egress, which is unmetered right up until a GIF gets popular or somebody hotlinks it into a page with real traffic
- Every link you have already shared, on the day you stop paying for the bucket — two-year-old support tickets now contain broken images
- Video, where "one sitting" quietly becomes an encoding queue, a worker, a retry policy and a bill
- Screen-recording permissions on macOS and Windows, which change with the OS and fail by producing black frames rather than an error
It starts as a good week. The tool works, everyone in support has the hotkey, and links are flying into tickets. Then somebody pastes one into a public community thread to show a customer how to fix their sidebar, and the capture is the whole window: the admin console with that customer's account open in it, name, email, plan, last four digits, and a long session URL in the address bar. Nobody notices for three weeks, because not noticing is the feature. What surfaces it is a search result — the bucket has public read and permissive robots, so the image is indexed under the customer's own name. Deleting the object takes a minute. The forum's link preview still holds the thumbnail, the search index keeps its copy until the next crawl, and there is no access log because logging was phase two, so the question "who has seen this" has no answer you can give the customer's legal contact. The bug was never in the upload code. It was that a keystroke published a frame nobody had read.
Is that you?
the verdict is a default, not a law
- Captures stop at the filesystem and sharing means attaching a file, which is CleanShot's job and a fine weekend
- Uploads go to a private store and are served through an authenticated viewer to an audience you can name
- Links expire by default, and you chose that default before the first upload rather than after the first incident
- It is you alone, on your own screen, with nothing that belongs to a customer or an employer ever in frame
- The links go to customers, or into public threads and tickets
- You capture screens with other people's data on them — a CRM, an inbox, a support console, a shared calendar
- There is no expiry, no access log and no per-object revocation
- You could not answer "who viewed this, and when" three weeks later
- The links need to keep resolving after you lose interest, which is the promise you make when you paste the first one
If you build it anyway
the checklist, then the prompt that enforces it
- Build the review step before the upload step. Capture, show me the image, then a Send button. The entire risk in this product lives in that missing second.
- Private by default, expiring by default: signed URLs with a lifetime in days, and revocation that genuinely revokes rather than un-listing.
- Random opaque object keys. Never timestamps, never counters — enumerable keys convert one leaked link into your whole archive.
- Turn on access logging before the first upload. "Who saw this" is the question you will be asked and the only one you cannot backfill.
- Redaction must be destructive: flatten the black box into the pixels and upload the flattened image. Never upload an original with an overlay drawn on top of it.
- Add one dumb pre-flight check — does the frame contain an address bar, a long token-shaped string, a full-screen browser window — and make it interrupt rather than warn. It will pay for itself in the first month.
- One delete operation that removes the object, the CDN cache entry, the thumbnail and the database row, with a test proving all four are gone.
- Write down, in the README, what happens when you stop paying: an export of every capture with its link ID so that a cheap static redirector can keep old URLs alive.
- Do not put this on a branded domain you might drop. Losing the domain takes every link you have ever shared with it.
I am building a screen-capture tool that uploads to my own storage and copies a
share link to the clipboard. The failure I care about is publishing a frame nobody
reviewed — a customer's record, a token in a terminal — at a URL with no expiry and
no log. Order the work so that cannot happen, and push back when I ask for speed.
1. Phase one is local only: capture, annotate, save to disk, copy the file. No
network code at all. Make me use it for a day before you add uploading.
2. When uploading lands, it is never automatic. Capture opens a preview with an
explicit Send action. Do not offer a "skip preview" setting, and if I ask for one,
explain what it costs.
3. The bucket is private, no public read policy, no directory listing. Reads go
through my own endpoint that checks the share token and logs the request.
4. Object keys are 128 bits of randomness. Never timestamps, never sequences, never
the original filename.
5. Share links expire. Default 30 days, configurable per capture, and revocation
deletes the object as well as the token.
6. Access logging and a storage lifecycle policy are created in the same commit as
the bucket, not afterwards.
7. Redaction flattens into the image before upload. Refuse to implement a redaction
overlay that leaves the original pixels underneath, and say why.
8. Before the share link is generated, run a pre-flight on the frame: warn me loudly
if it looks like a browser address bar, an email client, or contains a long
high-entropy string. An interrupting dialog, not a toast.
9. Implement delete early and completely: object, CDN cache entry, generated
thumbnail, database row. Write the test that proves all four are gone.
10. Rate-limit and size-cap uploads, and set a hard monthly egress ceiling with an
alert, because one popular GIF is the whole bill. Video transcoding,
transcription and team accounts are out of scope unless I ask again.
11. Finish by telling me every link I share becomes a promise to keep a bucket alive,
and asking how many years I intend to keep it — and that Zight's free tier and
$9.95 plan exist precisely to make that somebody else's problem.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Any capture that includes a screen belonging to your employer or your customers. $9.95 per person per month buys the unglamorous custodial half: expiry, password protection, per-item access control, an access log, a retention policy, and the fact that when a screenshot of somebody's account goes somewhere it should not, there is a delete that actually deletes and a log that answers who saw it. Their free tier covers casual personal use, so the honest split is: build the local capture tool for yourself, buy the sharing when other people are in the frame.
$9.95/mo is cheaper than your weekend.
Every capture is a file plus a link ID, so the storage side migrates in an afternoon: keep one bucket you can rclone out wholesale, and keep a manifest mapping link ID to object key, date and — if you can — where it was shared. The URLs are what will not migrate. The day you change domains, stop paying or lose interest, every link sitting in every ticket, thread and email you have ever pasted into breaks at once, and the only real mitigation is a static redirector cheap enough that you will keep it running for years after the tool is dead. Decide up front how long you are promising, and prefer expiring links so that the promise has an end date you chose.
Open-source screen recording and sharing with a modern desktop architecture and a self-hostable storage backend.
The DIY version of this that already exists: capture plus a configurable custom uploader, on Windows, for free.
Questions
Is Zight the same thing as CloudApp?
Yes. CloudApp announced the rename to Zight in April 2023 and said existing workflows and pricing were unchanged. The product is actively developed — the current plan page advertises an MCP integration, SOC 2 Type II, and HIPAA plus custom S3 storage on the enterprise tier — so this is a rebrand, not a wind-down. The plan names in the imported data are simply out of date: there is no Pro tier now.
CleanShot X is SHIP IT here. Why is this YOUR FUNERAL?
One feature: the hosted link. CleanShot's failure mode is a screenshot you have to attach manually, which is annoying. Zight's failure mode is a public URL created before anyone looked at the image, pasted somewhere you do not control, resolving forever. Everything harsh on this page is downstream of that single keystroke. Build the local capture tool — genuinely, it is a good weekend — and stop before the upload.
What is the minimum version that is not reckless?
Local capture and annotation, a private bucket with random keys, signed URLs that expire in thirty days, an explicit preview-and-send step, access logging on from day one, and a delete that removes the object, the thumbnail, the CDN entry and the row. That list is a couple of evenings longer than the version you were going to build, and it is the difference between a tool and an incident.
- GDPR Art. 5 — principles relating to processing of personal data (EU)
- GDPR Art. 32 — security of processing (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice