What if 01
What happens if a bot finds the form?
A script can send thousands of messages a minute, and the warning above is what you’d wake up to. Now nothing leaves the form until a reCAPTCHA is passed.
Can vibe coding be safe?
A client’s website, built with AI. It looked finished. The real question was what would happen once strangers started using it.
- Role
- Designer & vibe coder
- Timeline
- 2 months
- Client
- Maëlle, stunt performer
- Focus
- Security testing, privacy
This never happened. Here’s why.
What if 02
What happens if someone types what the form doesn’t expect?
A missing name, a broken email, a message that never ends. Each one is stopped on the spot, before anything is sent.
What if 03
What happens if someone pastes code instead of a message?
I tried it myself: a raw <script> tag in the message field. It stays plain text, never runs, and the form refuses to send it.
What if 04
What happens if a secret ends up on GitHub?
Nothing worth stealing lives in the front end, and environment files never reach the repository. The rest is tracked on a checklist.
Key takeaways
- Pasting HTML and script tags into a client’s form takes five minutes and tells you right away whether input is actually sanitised.
- A privacy policy and reCAPTCHA are cheap to add and pull double duty: they build trust with a client’s users and cut down the spam.
- Character limits aren’t just nice to have; they cut down how much weird or oversized input a form ever has to deal with.
ToolsClaude, Antigravity, reCAPTCHA, Formspree, HTML/CSS