Should I vibe code
Photo editing, templates, retouching, and AI image tools
The AI half is one API call. So is the abuse: a stranger's photo, your GPU bill, your takedown obligation.
?
Their verdict, the Fotor Pro price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-05.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Fotor is three products in a trenchcoat, and they have completely different answers. The editing operations — crop, resize, curves, background removal, upscaling — are library calls, and the BeFunky entry makes that case already. The template and font library is a licensing exercise you are not going to do. The third product is the one that changed since that entry was written, and it is the reason this one exists: half of Fotor's navigation is now AI tools applied to photographs of people. Hairstyle changer, clothes changer, headshot generator, remove-a-person, watermark remover. Those are one API call each, which is precisely the problem, because the thing you can ship in an evening is a public endpoint that alters images of humans and bills you per generation. You will build the demo and it will be genuinely impressive. What you will not have built is a moderation queue, a spend cap, or an answer for the person in the photograph who did not upload it.
What actually breaks
not "if". the specific failures.
- The bill, first and fastest: a public endpoint in front of a metered image model has no natural rate limit, and the people who find it first are running it in a loop
- The upload path, where an untrusted file goes straight into an image decoder — the oldest reliable route to running somebody else's code on your server, with ImageMagick and libwebp holding the receipts
- Moderation, which does not exist, because it is a rota and a review queue rather than a feature you can generate
- The consent gap. Everything in the AI half operates on a face, and nothing in your app knows whether the person in the photograph agreed to be edited or has ever heard of you
- Provenance, when your output has no C2PA metadata and no visible marker, so a synthetic image of a real person leaves your service indistinguishable from a photograph
- The browser editor on a 40-megapixel file, which is where the actual engineering was and where your tab dies
- Colour management, quietly: drop the ICC profile on the way in and every export comes back subtly wrong on somebody else's monitor
- Model archaeology — the upscaler that works today is a weights file on somebody's host, under a licence that can change, behind an endpoint that can be deprecated with ninety days' notice
Is that you?
the verdict is a default, not a law
- It runs on your machine over your own folder, and the only images it touches are yours
- It is a CLI or a script, not a hosted endpoint, so there is no upload path and no bill to run up
- The AI parts call a model you pay for with a hard monthly cap, and nothing is exposed to anyone but you
- You are automating one repetitive operation — batch resize, batch background removal — rather than rebuilding an editor
- Strangers can upload, which turns your key and your quota into a shared resource with no owner
- Any feature alters a person: face, body, clothing, age, or removing someone from a photo
- There is no spend cap, because a metered model behind an open form is a bill that grows while you sleep
- You have no way to receive a complaint about an image and act on it within a day
- You are relying on it for client work and the model behind it is an endpoint you do not control
If you build it anyway
the checklist, then the prompt that enforces it
- Keep it local. A CLI over your own folder has none of the problems on this page and delivers most of the value.
- If it goes online, put authentication in front of generation before you put a UI in front of it. Anonymous generation is a bill and an abuse queue, in that order.
- Set a hard spend cap at the provider, not in your code, and an alert well below it. Your rate limiter has a bug; the provider's cap does not.
- Never pass an uploaded file to a decoder in your main process. Sandbox it, cap dimensions and pixel count before decode, and validate by content rather than by extension.
- Decide explicitly whether you support edits to images of people. If yes, you need a reporting path, a named human who reads it, and a documented removal turnaround — write those down before the feature ships.
- Attach C2PA or equivalent provenance metadata to generated output, and do not strip it from inputs that carry it.
- Preserve ICC profiles and the EXIF orientation flag through the pipeline; strip GPS. Most one-line strip commands get this exactly backwards.
- Pin model versions and keep the previous one reachable, because 'the upscaler looks different today' is otherwise an unfixable bug report.
I am building a photo editor with AI tools, including ones that alter
photographs of people. Assume it will be reachable from the internet and
that the first heavy users will not be customers. Build the limits before
the features.
1. Default to a local CLI over a folder of my own images. Ask me directly
whether this needs to be hosted before you write a single upload handler.
2. If it is hosted, authentication goes in front of generation before any UI
exists. Anonymous generation is a bill and an abuse queue, in that order.
3. Set a hard provider-side spend cap plus an alert well below it, and say
plainly that my own rate limiter will have a bug and the provider's cap
will not.
4. Never hand an uploaded file to a decoder in the main process. Sandbox it,
cap dimensions and total pixels before decode, and detect type by
content, never by filename.
5. Ask me explicitly whether the tools may operate on images of people. If I
say yes, build the report path, name who reads it, and record a removal
turnaround in the README before shipping the feature.
6. Attach C2PA provenance to generated output and never strip it from inputs
that carry it.
7. Preserve ICC profiles and the EXIF orientation flag end to end, and strip
GPS. Warn me that the usual one-line strip command does the reverse of
all three.
8. Pin model and weights versions, keep the previous version callable, and
treat "the upscaler looks different today" as a bug rather than weather.
9. Delete uploads on a schedule by default, and tell me the retention period
you chose rather than leaving the bucket to grow.
10. Out of scope unless I ask: templates, a font library, accounts, sharing,
anything that stores an image longer than one session.
11. Finish by telling me which parts of this I would be renting rather than
owning, and what the API bill looks like at a thousand images a month.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
For the template library and the browser editor, immediately — those are the two things you genuinely cannot rebuild, and they are most of what people open Fotor for. For the AI tools the calculation is different and worth doing honestly: you are paying a subscription for a wrapper over models you can call directly, and if your usage is a few dozen images a month the API bill is smaller than the plan. The reason to still buy is not the model. It is that hosting image generation for anybody other than yourself comes with a moderation queue, a spend risk and a removal obligation, and a subscription is how you make all three somebody else's job.
There is barely anything to exit from, which is the nicest thing on this page. Keep the originals — untouched, in folders, with their metadata intact — and every edit as a recipe rather than a destination: a JSON list of operations and parameters you can replay against a different backend when the model you called is retired. If you did host it, the exit has one obligatory step: delete the uploads. Other people's photographs sitting in a bucket attached to an app nobody maintains is the only part of this that gets worse with time.
Browser-based image editor with layers and filters, which is the canvas half you would otherwise be writing.
Node-based open-source diffusion engine that covers the generative tools without a per-image bill.
Questions
BeFunky's entry scores 34 and this one scores 44. Same category — what moved?
The AI half, and what it is pointed at. BeFunky's entry is about an editor: the hard parts are colour management, non-destructive editing and a template library, and none of those hurt anyone. Fotor's current navigation is dominated by tools that modify photographs of people, and hosting those is a different business with a reporting obligation and a metered bill attached. The editor half of this entry is BeFunky's answer. The rest is new.
Is a hobby project really covered by takedown law?
The TAKE IT DOWN Act's notice-and-removal duty applies to covered platforms that host user content, and its compliance deadline passed in May 2026; there is no hobbyist carve-out in the way people assume. More practically, the question that decides your weekend is not whether a regulator writes to you — it is whether you have a way to receive a report about an image and act on it before it matters. If the answer is 'my email, sometimes', do not host it.
What is the version of this that is actually a good idea?
A script. Point it at a folder, have it resize, strip GPS, remove backgrounds and write the results next to the originals, and you have replaced the ninety percent of Fotor you were using while keeping the ten percent that matters — the originals, on your disk, unmodified. No upload endpoint, no bill, no moderation. It is genuinely a good afternoon and nothing in this entry applies to it.
- TAKE IT DOWN Act, S.146 — 119th Congress (notice-and-removal duty for covered platforms)
- GDPR Art. 5 — principles relating to processing of personal data (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Every operation is a library call. The product is that it runs in a browser tab on a 40MP file without dying.
Background removal is a model someone else trained and gave away. Point it at a folder and stop paying per image.
The editor is hard, the template library is harder, and the font licensing is a legal department.
last reviewed 2026-08-05 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice