Can I vibe code ShopProtector?

Build a lightweight bot protection system and script injection for an eCommerce storefront to prevent automated spam on contact forms, account creation, and cart submission. 1. Data Architecture: Define a PostgreSQL schema or Upstash Redis store to keep track of request logs, blocked IP addresses, email domain blacklists, and event logs containing timestamp, path, client IP, risk score, and outcome. 2. Client Injection Script: Write a vanilla JavaScript module designed to run on storefront pages. It must inject a hidden honeypot DOM input field (`style='display:none'`) into selected forms and load Cloudflare Turnstile unobtrusively. Collect basic browser telemetry including time-to-submit delta, mouse movement presence, and keyboard velocity. 3. Validation API: Create a serverless API route (Vercel Edge or Cloudflare Worker). Upon form POST, verify the Cloudflare Turnstile response token via official REST API, check whether the honeypot field has been filled by an automated bot, enforce IP rate-limiting (maximum 5 submissions per 10 minutes per IP using a sliding window counter), and compute an aggregate risk score from 0 to 100. If the risk score exceeds 70 or honeypot is populated, reject request with a 403 status. 4. Admin Management Dashboard: Build a minimal Next.js dashboard showing recent blocked submissions, configurable threshold sliders, manual IP whitelist/blacklist management, and daily caught-spam analytics. 5. Resiliency & Edge Cases: Implement fail-open logic where if the third-party Turnstile API times out or returns a 5xx error, the form submission is allowed through while logging a warning. Account for mobile touch events so tap sequences are not misclassified as bot activity.

$ each button prefixes agent-specific run instructions · build your own product, never copy proprietary code, trademarks or designs