Should I vibe code
Centralize manually imported feedback, tag it, and connect it to feature decisions
Nobody pays for the feedback board. They pay for the nine connectors that fill it, and those break one at a time.
?
Their verdict, the Essential price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-04.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
Everyone reads this as a feedback board and builds the board, which is two tables and an afternoon. Savio is not a board — it is the plumbing that fills one. Feedback arrives from Intercom, Zendesk, Help Scout, Slack, HubSpot and Salesforce, each request is attached to the customer who asked and to what that customer pays, and the output is pushed into Jira, Linear or Shortcut. Take the connectors away and what remains is a spreadsheet with nicer tags. So the honest failure here is not danger, it is abandonment: you will wire two integrations, discover that the third needs pagination and a webhook replay and a token refresh, and go back to a Notion page. Worth knowing before you start: those connectors make your side project a second home for support conversations and customer records, and support conversations contain whatever customers typed in a panic, up to and including their own credentials.
What actually breaks
not "if". the specific failures.
- The connectors, one at a time and never on the same week — a token expires, a webhook signature changes, a vendor deprecates a v2 endpoint, and the import goes quiet without failing
- Deduplication, so the same customer's request arrives from Intercom and Slack and Salesforce as three separate votes and the prioritisation is now arithmetic on double-counted people
- The revenue attached to each request, which is a stale copy of an MRR figure from billing and quietly disagrees with finance's number in the meeting where it matters
- The integration token's blast radius, because the fastest OAuth scope to request from Intercom or Salesforce is the broad one, and a read-everything grant lives on long after the person who clicked Approve
- Support conversations as a data class: attachments, screenshots with account details in them, and the occasional password a customer pasted while asking for help, now mirrored into a database with no access log
- Deletion, which used to mean deleting from Zendesk and now means finding every copy in your own store too
- The close-the-loop email, the one that tells forty customers their request shipped, sent from a script with no preview, no per-recipient check and no undo
- The tagging taxonomy, which starts clean and is unusable by month four because nobody owns it
Is that you?
the verdict is a default, not a law
- It reads from one source you already pay for, and everything else is pasted in by hand
- You store a link back to the original conversation rather than a copy of its text
- It is internal, behind your existing SSO, and no customer can see or write to it
- Nothing it holds would be awkward to describe in a breach notice — which usually means no support transcripts
- You are mirroring full support conversations and CRM records into a database nobody audits
- Integration tokens carry write scopes, or belong to a person rather than a service account
- It emails customers when something ships and there is no preview, no suppression list and no rate limit on the send
- The MRR figure it displays comes from a nightly copy and gets quoted as current in planning meetings
- Nobody has agreed to own the taxonomy, in which case the tool is a graveyard with a search box
If you build it anyway
the checklist, then the prompt that enforces it
- Link, do not copy. Store the source system, the conversation ID and a short excerpt; fetch the rest on demand. A pointer cannot leak the whole ticket.
- One service account per integration, read-only scopes, credentials encrypted with a key outside the database, and a documented list of exactly which scopes you asked for and why.
- Deduplicate on the customer identity, not on the message. Two channels reporting the same request must collapse to one vote or your prioritisation is measuring how many tools a customer uses.
- Show provenance on every item: which system it came from, when it was imported, and the fetch time of the revenue figure sitting next to it. Stale money is the number people misquote.
- Make a failed sync loud. A connector that has silently imported nothing since Tuesday is worse than one that is visibly broken, because the board looks complete.
- Put customer notification behind a human: a preview, a recipient list you can read, a suppression list, and a hard cap on how many go out per run.
- Inherit access control from your identity provider rather than building your own logins, and log who exported what. This tool is a search interface over customer conversations.
- Agree the retention window and the deletion path before importing anything, because a GDPR erasure request now has two systems to satisfy and yours is the one nobody documented.
I am building an internal tool that pulls customer feedback out of our support
and CRM systems, tags it, attaches revenue, and pushes it to our issue tracker.
It is full of other people's conversations. Build it in this order.
1. Start with one connector, not nine. Pick the noisiest source, make it
correct, and tell me what the second one will cost in maintenance before we
add it.
2. Store references, not copies: source system, external ID, permalink,
requester ID and a short excerpt. If I ask you to mirror full conversation
bodies, warn me that support tickets contain attachments, screenshots and
occasionally credentials, and make me decide deliberately.
3. Integration credentials are per-service-account, read-only scopes only,
encrypted at rest with a key outside the database. Print the scopes you
requested into the README with a reason for each.
4. Sync health before features: last successful run per connector, records
imported, and an alert when a source goes quiet against its own baseline. A
silent connector must not look like a slow week.
5. Deduplicate on customer identity across sources before anything counts votes
or sorts a list.
6. Every item and every number carries provenance in the UI — source, import
time, and the fetch time of the MRR figure beside it.
7. Authentication comes from our existing identity provider; do not write a
login system. Log reads and exports too — a search box over customer
conversations needs an audit trail even when it is internal.
8. Deletion path before import path: one operation, keyed on the customer, that
removes their feedback, excerpts and any embeddings from every table.
9. If I ask for customer-facing notifications when a request ships, require a
preview, an explicit recipient list, a suppression list and a send cap — and
tell me that is bulk email with our domain's reputation attached.
10. Out of scope: a public voting board, anonymous submissions, and write-back
to the CRM. Each is a separate decision with its own failure mode.That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
When the second connector is due. What the subscription buys is the unglamorous half — nine integrations that keep working, deduplication across them, and the customer-and-revenue join that makes the prioritisation argument in the first place — and Savio's own shape (unlimited free contributor and viewer seats, paid seats for the people who administer it) means the cost tracks how many people actually run the process rather than how many read it. Build your own only if one support inbox is your whole world.
$39/mo is cheaper than your weekend.
Because the value is in the connectors rather than the store, the exit is easier than it looks — provided you kept links rather than copies. Export tagged items as CSV or newline-delimited JSON with their source permalinks and their tracker IDs, and everything is re-attachable in Savio, a Notion database or a spreadsheet. Revoke each OAuth grant at the vendor rather than deleting your credential rows, then delete the mirrored conversation text: a dead internal tool holding two years of support transcripts is the kind of thing that turns up in a due-diligence questionnaire long after everyone forgot it existed.
Open-source feedback portal with posts, votes and status workflows — the public-board half, not the CRM-integration half this product sells.
Questions
How is this different from the Canny, Nolt and Featurebase entries?
Those are public boards, so their whole risk story is that a writable endpoint on your domain attracts spam and that "Planned" is a promise in writing. Savio's board is internal and nobody outside your company touches it. The risk moves inward instead: you are aggregating other companies' support conversations and customer records into a store with no audit trail, and your entire value proposition depends on integrations you did not write and cannot version-pin.
Why score data sensitivity so high for an internal tool?
Because of what support transcripts actually contain. People troubleshooting an account paste API keys, order numbers, addresses, screenshots of their dashboards and occasionally their own passwords. Zendesk and Intercom have permissions, retention settings and audit logs for exactly that reason. Copying the text into a weekend project means the same content now lives somewhere with none of them.
What is the smallest version that is actually useful?
A tagged list where each row is a permalink to the original conversation plus the customer and a one-line summary, populated from one source, with a weekly review slot in somebody's calendar. That gets you the argument you wanted — this request is worth this much revenue — and it needs no vote counting, no notifications and no second connector.
- GDPR Art. 5 — principles relating to processing of personal data (EU)
- GDPR Art. 32 — security of processing (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
A public feedback board is a public spam target with a voting mechanism attached.
An open post box on your own domain is a spam farm with your favicon on it.
A public roadmap is a promise with a timestamp. The board takes an afternoon; the year of keeping it honest does not.
last reviewed 2026-08-04 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice