Skip to content
VVibeAndSell.comFrom vibe to value

Developer notes

Prototype security notes

How this front-end prototype handles input, storage and rendering.

Input handling

  • Every free-text field has an explicit maximum length
  • Angle brackets and control characters are stripped on entry
  • URLs are validated against an https-only allowlist; javascript: and data: are rejected
  • File pickers accept PNG, JPEG, WebP and PDF only, with a size cap

Rendering

No user-supplied string is ever rendered as HTML. dangerouslySetInnerHTML is not used anywhere in the app.

Storage

Only non-sensitive draft state is written to local storage, under namespaced keys, wrapped in try/catch so private-mode failures degrade quietly.

Rate limiting

A front-end courtesy limiter throttles repeated form submissions. It is a UX guardrail, not a security control — real enforcement belongs server-side.

Not implemented in this prototype

  • Authentication, sessions and roles
  • Server-side validation and authorisation
  • File upload storage and virus scanning
  • Payments, escrow and identity verification

VibeAndSell is an informational prototype. Nothing here is legal, financial, investment or appraisal advice, and no listing, party or outcome is verified or guaranteed.