Can I vibe code Fingerprint?

Build a self-hosted device identification and promo abuse prevention service using Node.js, Express, and Redis.

1. CLIENT-SIDE SCRIPT:
- Embed the open-source `@fingerprintjs/fingerprintjs` library into a lightweight frontend script.
- Collect client hardware signals: screen dimensions, color depth, timezone, canvas rendering hash, webgl vendor/renderer string, audio context hash, system language, available fonts, and platform details.
- Transmit the client-generated payload alongside session cookies to POST `/api/v1/verify-device` using fetch.

2. SERVER-SIDE RISK ASSESSMENT:
- Extract request headers: raw IP address (handling X-Forwarded-For securely), User-Agent, Accept-Language, and Sec-Ch-Ua headers.
- Calculate a deterministic server-side hash by combining client payload components and raw IP address.
- Store device records in Redis with key format `device:{hash}` storing: first_seen, last_seen, request_count, associated_user_ids (array), promo_codes_claimed (array).
- Evaluate suspicious signals: rapid user-agent switching on same hash, high velocity requests (>10 requests/minute), IP country mismatch with billing address.

3. PROMO ABUSE & BOT DETECTION RULES:
- Implement logic in `/api/v1/check-promo`: Reject coupon application if device hash has claimed >1 promo within 30 days, or if associated with >2 distinct user accounts.
- Implement basic headless browser checks (check for missing plugins, navigator.webdriver === true, or automated user-agent strings).

4. FAILURE MODES & EDGE CASES:
- Fallback gracefully to cookie-based tracking if browser blocks canvas/webgl context.
- Standardize IP subnet aggregation to avoid misidentifying dynamic mobile network IP changes as distinct users.
- Ensure strict CORS enforcement on the ingestion endpoint to prevent third-party telemetry injection.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs