# Build brief — a focused alternative to CineSend

> **Verdict:** Not faithfully · **Buildability:** 6/100 · **Category:** Audio Video
> **Source:** https://www.canitbevibecoded.com/cinesend
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from CineSend. Verify current pricing and capabilities before acting.

## Context

**CineSend** — Secure screener and media delivery with DRM, forensic watermarking, geo-blocking, and view limits. It currently costs $797/mo.

The file delivery is not the product. The product is that A24, HBO, and Sundance accept it. A screener page with an expiring link is trivial, and it buys you nothing, because the two things CineSend actually sells cannot be written by an agent at any price: forensic watermarking, which is a licensed product from Nagra that survives a camcorder pointed at a monitor and traces the leak back to one named viewer, and studio-grade DRM, which needs license keys Google and Apple issue to companies, not to your VPS. Underneath both sits the part no code touches · a rights holder's legal team signing off on where their unreleased master is allowed to sit. You can build a private video page. You cannot build permission to receive the film.

This brief describes a focused, single-operator replacement for the part of CineSend that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

The honest floor: expiring private screener links with a visible per-viewer burn-in, view limits, and an access log. Deterrence, not security.

- Build a focused single-user workflow with real persistence, search, and export.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Ffmpeg.
- Object storage plus a CDN.
- A VPS for the screener pages.
- An email sender for invites.
- An accurate understanding of what a visible watermark does and does not stop.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build me a watermarked private screener site for footage I own: my own film,
a rough cut for producers, a festival submission I control. This is the
deliberately low-stakes floor of CineSend, never a substitute for it when
someone else's unreleased master is involved. Requirements:

- Node + Express + better-sqlite3 on a VPS, media in Cloudflare R2, hls.js for
  playback. Server-rendered pages, no frontend framework.
- I invite viewers by name and email. Each gets a single-use /s/<random-id> link tied
  to that address, with an expiry date and a max view count I set per invite.
- ffmpeg burns the viewer's name, email, and the date into the picture as a semi
  transparent overlay, one encode per viewer, cached in R2 and deleted on expiry. It
  is visible and it is meant to be, deterrence is the entire mechanism.
- Every play logs timestamp, IP, user agent, and how far they watched, shown on an
  /admin page behind basic auth. I can revoke any link instantly.
- Downloads are off, right click is off, and the manifest URL is signed and short
  lived. State plainly in the UI that none of this stops a screen recording.
- SQLite holds invites and the access log, R2 keys and the SMTP credentials come from
  .env. No accounts for viewers, no telemetry, no third party analytics.
- Out of scope: DRM, forensic watermarking, and TV apps. Do not claim to implement
  any of them and do not build a fake watermark that only sounds forensic.
- README: R2 and signed URL setup, per-viewer encode cost and time, and one blunt
  paragraph saying this is deterrence only and must never be used for a title under
  someone else's security requirements.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- NexGuard forensic watermarking that survives re-encoding and a phone pointed at the screen.
- Widevine, FairPlay, and PlayReady DRM, which require licensed keys issued to companies.
- The studio and festival trust that makes anyone send you a master in the first place.
- Aspera acceleration for moving finished masters across continents.
- Trust, audits, and counterparties matter more than feature parity.
- Compliance, licensing, and legal accountability are core features.

## What you still own after launch

- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.

## Risk

**High consequence.** Use this as a prototype or personal aid. Keep a qualified human and an established provider in the loop for consequential decisions.

Editorial confidence in this assessment: high. No independent one-shot implementation is linked yet.

## Prior art

Working open-source software you can read, fork, or borrow from before starting:

- [Nextcloud](https://github.com/nextcloud/server) — Self-hosted file sharing with password-protected, expiring share links and access logs. Genuinely solves the delivery half, and stops exactly where the licensed half starts
- [Shaka Packager](https://github.com/shaka-project/shaka-packager) — Open-source packaging with Common Encryption for Widevine and other DRM systems. Shows the wall clearly: you can encrypt the stream, but the license server and the device keys are not yours to issue

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/cinesend