Can CineSend be vibe coded?
Secure screener and media delivery with DRM, forensic watermarking, geo-blocking, and view limits
The file delivery is not the product. The product is that A24, HBO, and Sundance accept it. A screener page with an expiring link is trivial, and it buys you nothing, because the two things CineSend actually sells cannot be written by an agent at any price: forensic watermarking, which is a licensed product from Nagra that survives a camcorder pointed at a monitor and traces the leak back to one named viewer, and studio-grade DRM, which needs license keys Google and Apple issue to companies, not to your VPS. Underneath both sits the part no code touches · a rights holder's legal team signing off on where their unreleased master is allowed to sit. You can build a private video page. You cannot build permission to receive the film.
Jump to the build brief ↓Checked Jul 2026
What you pay today, before any DIY hosting
high editorial confidence
Buildability by layer
Screens, forms, and focused interactions
The repeatable job the product performs
Availability and legality of required data
Uptime, queues, support, and maintenance
Security, compliance, and user confidence
The achievable core
- The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.
- Build a focused single-user workflow with real persistence, search, and export.
- A responsive interface with real empty, loading, success, and error states.
The parts a prompt cannot buy
- NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen
- Widevine, FairPlay, and PlayReady DRM, which require licensed keys issued to companies
- the studio and festival trust that makes anyone send you a master in the first place
- Aspera acceleration for moving finished masters across continents
- Trust, audits, and counterparties matter more than feature parity.
- Compliance, licensing, and legal accountability are core features.
Why people still pay
They pay to be allowed to hold the file. A distributor's security requirements are a contract term, not a preference, and the accepted vendor list is short on purpose. When a screener leaks, forensic watermarking turns a catastrophe into a phone call to one person, and that single capability justifies the whole line item. Nobody is paying 797 dollars a month for a download page.
Trust, audits, and counterparties matter more than feature parity.
Compliance, licensing, and legal accountability are core features.
Reliability at the vendor's scale is an operations problem, not a prompt.
The brief
Context, requirements, acceptance criteria, non-goals, and the full production standard — as Markdown, ready for any coding agent.
Build brief — a focused alternative to CineSend
Context
**CineSend** — Secure screener and media delivery with DRM, forensic watermarking, geo-blocking, and view limits. It currently costs $797/mo.
The file delivery is not the product. The product is that A24, HBO, and Sundance accept it. A screener page with an expiring link is trivial, and it buys you nothing, because the two things CineSend actually sells cannot be written by an agent at any price: forensic watermarking, which is a licensed product from Nagra that survives a camcorder pointed at a monitor and traces the leak back to one named viewer, and studio-grade DRM, which needs license keys Google and Apple issue to companies, not to your VPS. Underneath both sits the part no code touches · a rights holder's legal team signing off on where their unreleased master is allowed to sit. You can build a private video page. You cannot build permission to receive the film.
This brief describes a focused, single-operator replacement for the part of CineSend that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.
What you are building
The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.
Build a focused single-user workflow with real persistence, search, and export.
A responsive interface with real empty, loading, success, and error states.
Requirements
Functional
Ffmpeg.
Object storage plus a CDN.
A VPS for the screener pages.
An email sender for invites.
An accurate understanding of what a visible watermark does and does not stop.
Non-functional
Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
Security: server-side secrets, validated input, and no credentials in the client bundle.
Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
Portability: the operator can export their data and leave without losing it.
Implementation brief
Build me a watermarked private screener site for footage I own: my own film,
a rough cut for producers, a festival submission I control. This is the
deliberately low-stakes floor of CineSend, never a substitute for it when
someone else's unreleased master is involved. Requirements:
Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for
playback. Server-rendered pages, no frontend framework.
I invite viewers by name and email. Each gets a single-use /s/<random-id> link tied
to that address, with an expiry date and a max view count I set per invite.
ffmpeg burns the viewer's name, email, and the date into the picture as a semi
transparent overlay, one encode per viewer, cached in R2 and deleted on expiry. It
is visible and it is meant to be, deterrence is the entire mechanism.
Every play logs timestamp, IP, user agent, and how far they watched, shown on an
/admin page behind basic auth. I can revoke any link instantly.
Downloads are off, right click is off, and the manifest URL is signed and short
lived. State plainly in the UI that none of this stops a screen recording.
SQLite holds invites and the access log, R2 keys and the SMTP credentials come from
.env. No accounts for viewers, no telemetry, no third party analytics.
Out of scope: DRM, forensic watermarking, and TV apps. Do not claim to implement
any of them and do not build a fake watermark that only sounds forensic.
README: R2 and signed URL setup, per-viewer encode cost and time, and one blunt
paragraph saying this is deterrence only and must never be used for a title under
someone else's security requirements.
Delivery standard
Inspect the repository first, then write a short implementation plan before writing code.
Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
Add structured logs around every external call and return actionable errors without leaking sensitive details.
Write unit tests for the core logic and one automated test of the main user journey.
Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.
Acceptance criteria
A clean install starts the app using only the README and .env.example.
The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
Tests, type checking, linting, and a production build all pass with no ignored failures.
No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.
Non-goals
Do not build these, and do not claim to have replaced them:
NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen.
Widevine, FairPlay, and PlayReady DRM, which require licensed keys issued to companies.
The studio and festival trust that makes anyone send you a master in the first place.
Aspera acceleration for moving finished masters across continents.
Trust, audits, and counterparties matter more than feature parity.
Compliance, licensing, and legal accountability are core features.
What you still own after launch
Run migrations, backups, restores, and dependency updates.
Test the critical journey after every model, API, or hosting change.
Monitor failures and fix the edge cases a first prompt will miss.
Risk
**High consequence.** Use this as a prototype or personal aid. Keep a qualified human and an established provider in the loop for consequential decisions.
Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.
Prior art
Working open-source software you can read, fork, or borrow from before starting:
[Nextcloud](https://github.com/nextcloud/server) — Self-hosted file sharing with password-protected, expiring share links and access logs. Genuinely solves the delivery half, and stops exactly where the licensed half starts
[Shaka Packager](https://github.com/shaka-project/shaka-packager) — Open-source packaging with Common Encryption for Widevine and other DRM systems. Shows the wall clearly: you can encrypt the stream, but the license server and the device keys are not yours to issue
Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/cinesend
You still own the product
- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
Open-source prior art
Self-hosted file sharing with password-protected, expiring share links and access logs. Genuinely solves the delivery half, and stops exactly where the licensed half starts.
View project ↗Shaka PackagerOpen-source packaging with Common Encryption for Widevine and other DRM systems. Shows the wall clearly: you can encrypt the stream, but the license server and the device keys are not yours to issue.
View project ↗Before you start
Can CineSend be vibe coded?
Not faithfully. The file delivery is not the product. The product is that A24, HBO, and Sundance accept it. A screener page with an expiring link is trivial, and it buys you nothing, because the two things CineSend actually sells cannot be written by an agent at any price: forensic watermarking, which is a licensed product from Nagra that survives a camcorder pointed at a monitor and traces the leak back to one named viewer, and studio-grade DRM, which needs license keys Google and Apple issue to companies, not to your VPS. Underneath both sits the part no code touches · a rights holder's legal team signing off on where their unreleased master is allowed to sit. You can build a private video page. You cannot build permission to receive the film.
What can an AI coding agent reproduce from CineSend?
The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security. Build a focused single-user workflow with real persistence, search, and export. A responsive interface with real empty, loading, success, and error states.
What will a DIY CineSend replacement still be missing?
NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen; Widevine, FairPlay, and PlayReady DRM, which require licensed keys issued to companies; the studio and festival trust that makes anyone send you a master in the first place; Aspera acceleration for moving finished masters across continents; Trust, audits, and counterparties matter more than feature parity.; Compliance, licensing, and legal accountability are core features.
What do I still own after building a CineSend alternative?
Run migrations, backups, restores, and dependency updates. Test the critical journey after every model, API, or hosting change. Monitor failures and fix the edge cases a first prompt will miss.