Draft · Dani's answers in gray are J.E.'s first stabs, pending her review

The web is full of sites that were built in an afternoon with a chatbot and now hold patient intake forms in a text file. That isn't a story about careless people. It's a story about tools that make the first ninety percent effortless and never mention the last ten. When that last ten percent comes due, the people who know call Dani Dino of Web Casa. This episode is about how she does the job, why the gap keeps appearing, and what to ask before anything ships that touches a lawyer or a medical record.

The dossier

Everything I can confirm, which is the part that matters, and the part I can't, which is the fun part.

CompanyWeb Casa. Building sites since before Google was a company. The domain is older than most of her clients' businesses.
Prior lifeChanel. She says. The invoice formatting supports it.
Field workCommandeered a yacht's Starlink to send a CLI prompt for a client whose deploy would not wait for shore.
RatesThe lowest in the free world. My claim, not hers. She just didn't argue.
SpecialtyMaking a site that was built fast into one that is safe, lawful and maintainable, or building it that way from the first commit.
ClearanceLegal practices and HIPAA-covered providers. The two categories where "it works" is the start of the job, not the end.

Part one: what vibe-coding actually ships

Vibe-coding is wonderful. You describe the thing, a model writes it, you look at the screen and it's there. I do it. Dani does it. The danger isn't the method and it isn't the person using it. It's what the tools stay quiet about: everything the model didn't mention because nobody told it the stakes. Here is the pattern Dani sees most often, next to what a finished build does instead. None of it is the owner's fault. The tool answered the question it was asked.

What shippedA contact form that emails the submission to Gmail and keeps a copy in a public folder "for backup".
What it neededEncrypted storage, access logs, a retention rule, and a signed agreement with every vendor that touches the data.
What shippedAn API key sitting in the front-end JavaScript, exactly where the example put it.
What it neededKeys on the server only, scoped to one job, rotated, and a build that fails if one leaks into the bundle.
What shippedA login the model wrote from memory: passwords compared in plain text, "remember me" forever.
What it neededA maintained auth library, hashed credentials, session expiry, and a way to revoke access the day someone leaves.
What shippedA privacy policy generated by the same chatbot, promising things the site doesn't do.
What it neededA policy that describes the actual data flow, reviewed by a human who will be named on it.
What shippedForty dependencies nobody chose, three already abandoned, one with a known hole.
What it neededA short list someone can defend, pinned, scanned, and updated on a schedule.

The model will happily build you a beautiful front door. Nobody told it to mention the back of the house.

Q1
You've been building sites since before Google. What's the thing about vibe-coding that's new, and what's the thing that's just 1998 again?

Her tenure, applied. Keeps it from being anti-AI.

Draft answer · Dani to reviewNew: the speed. You can go from an idea to a working page before lunch, and that's a real gift. 1998 again: the tools letting you ship something that works and calling it done. We had FrontPage sites holding credit card numbers in a text file. The tools got smarter. The gap they leave didn't.
Q2
Describe the first ten minutes of a rescue. You open the repo. What do you look at before you look at anything else?

The practical core.

Draft answer · Dani to reviewWhere the secrets are and where the data goes. Not the design, not the code quality. If the keys are in the bundle and the form submissions are sitting somewhere public, nothing else matters until that's fixed. Then I read the privacy policy and compare it to what the site actually does, because those are usually two different documents.
Q3
When is a vibe-coded site worth rescuing, and when do you tell the owner to start over?

Honest triage. Sets up the "build it right" half.

Draft answer · Dani to reviewIf the thing people like is the front, the layout, the words, the flow, I can usually keep that and rebuild underneath it. If the thing they like is the fact that it exists, we start over, and it's faster than they think. Starting over isn't a failure. It's the cost of the first draft, and the first draft was cheap.
Q4
The Starlink story. Tell it properly, and then tell me what it says about how you work.

The spy bit, with a point.

Draft answer · Dani to reviewA client's site was down, the fix was one command, and the only working connection within a mile was on a boat that wasn't mine. I asked nicely. What it says: the job is the client's business staying open, not the tools I happen to have. Also, ask nicely. It works more than people expect.

Most vibe-coded sites fail quietly. They leak a little, they break a little, nobody notices. Two kinds of business don't get that grace: law practices and anything covered by HIPAA. Their websites collect the most sensitive information a person will ever type into a form, and the rules about handling it were written by people with subpoena power. This is the part of the episode I built the whole thing around.

Q1
A clinic vibe-codes an intake form over a weekend. It works. Walk me through what's wrong with it before a single patient uses it.

Make the abstract concrete.

Draft answer · Dani to reviewWhere does the submission go, who can see it, how long does it live, and is there a signed agreement with every service in that chain? A weekend form usually fails all four. It's not that the clinic was careless. It's that the model never asked, because the model doesn't know a patient from a newsletter subscriber.
Q2
What does "built right from the start" mean for a HIPAA-covered site, in plain language? No acronyms.

The build-it-right pitch, without the jargon.

Draft answer · Dani to reviewDecide what you collect and collect only that. Keep it somewhere locked, with a record of who opened the lock. Have a signed promise from every company that handles it. Write down how long you keep it and actually delete it when that day comes. Then have a named human own all of that. That's the whole thing. Everything else is implementation.
Q3
For a law firm: what's the one thing on a typical firm website that would make you wince in a deposition?

Her legal-practice experience.

Draft answer · Dani to reviewA 'tell us about your case' box with no notice about what it does and doesn't create, feeding into a shared inbox the whole office reads. That's a confidentiality problem and an expectations problem in the same form field. It takes an hour to fix and almost nobody does.
Q4
What questions should an owner ask a developer, or a chatbot, before they trust it with regulated data?

The giveaway. Clips well.

Draft answer · Dani to reviewWhere does this data live? Who else can read it? What happens when someone leaves? Show me the agreement with the vendor. What do we delete, and when? If nobody can answer those yet, the site isn't finished. That's not a verdict on anyone. It's just the next job.
Q5
Chanel. What did luxury teach you about building for people who are paying you the least money in the free world?

The joke, redeemed.

Draft answer · Dani to reviewThat the quiet details are the whole product. Nobody at that level tolerates a seam showing. My clients don't pay Chanel money, but they get the same rule: if I'd be embarrassed for a stranger to open the back of it, it isn't finished.
Q6
Lightning round: one thing to let the AI build today, one thing never to let it touch.

The clip.

Draft answer · Dani to reviewLet it build the first draft of anything a person will see. Never let it decide where personal data goes. Those are different jobs, and only one of them has consequences you can't undo.

Part three: True or Told to Me

Six claims about Dani. Some are true, some I made up this week. She has to tell the audience which, and then explain the true ones, because the true ones are the ones nobody believes. The Starlink story is in there. So is Chanel. So is a thing about the rates I'm not allowed to print until she confirms it.

The point of the game, same as last episode: we are all getting worse at telling what's real, and the person who builds your website should be very, very good at it.

Five questions for anyone who says "I can build that for you"

Dani's five, in her words, go here when we record. Mine to start her off: what happens to the data when you're gone?

Sources and disclosure

  • Dani Dino is a friend of J.E. Lambert and a collaborator on client work. Web Casa is an independent studio; Streamlined Content refers website rebuilds and regulated builds to it.
  • "Lowest rates in the free world" is J.E.'s characterization, not a published price. Ask her.
  • The Chanel and Starlink details are as told to J.E. by Dani and will be confirmed on air. The vibe-coding failure patterns in part one are composites from rescues; no client is identifiable.
  • Nothing here is legal or compliance advice. For a covered entity, the named human in Q2 should be a qualified one.

Published on streamlinedcontent.com. Answers shown in gray are drafts written by J.E. for Dani's review and will be replaced with her own words. Reviewed by a human.