Vibe coding a data room app

20 Jun 2025

This is part 1 of a 2-part post. The first part is about my experience with vibe coding, or rather, AI-assisted programming with Windsurf. The second part is about how I set up the magic link authentication flow with Vercel.

The problem

To put these cool tools to use, I’ve been working on a couple of side projects. The one we’ll discuss here is a custom data room app for General Folders.

I evaluated several popular data room solutions to understand their strengths and limitations before deciding to work on a new one. Here’s how they compare:

Tool	Features	Limitations	Strengths
DocSend	Document analytics, granular access control	Limited customization, corporate aesthetic	Tracking investor engagement
Notion	Flexible organization, modern interface	Weak access controls, limited analytics	Early-stage startups with simple needs
Google Drive	Familiar interface, real-time collaboration	Poor presentation layer, generic experience	Teams already in Google ecosystem
Dropbox	Simple file sharing, version history	Limited structure for investor narrative	Basic file sharing needs

For a more thorough comparison of tools and features see ref 1 and ref 1b.

None of these tools fully meet my needs. DocSend’s tracking features often discourage investor engagement, while its templated approach limits storytelling. It’s also not cheap for cost-sensitive early stage startups. While a tool like Notion allows for customizations that are consistent with your brand, it doesn’t allow for the global control of the look and feel of pages in a project. Over time, it’s easy to have pages that look very different. We’re looking for an affordable solution that balances security with brand customization while preserving investor preferences.

The solution

Given that context, our goal is to build a secure platform, with a brand-consistent look and feel, for startups to share links to confidential documents with authenticated investors.

What we’re envisioning is one flavor of a file explorer for the browser. In addition to the file explorer, we can add on a file viewer, like a slide viewer or a doc viewer, and replicate the logic that DocSend or Google Workspace have built. However, apart from enabling for granular tracking it’s hard to justify the effort that goes into building a file viewer given the affordable price tag on Google Workspace products and the familiarity of the experience.

As a sidenote, this exercise made me realize that GitHub, Dropbox, and Box, are all file explorers at the core which is quite beautiful.

The tools

Now we get to the topic of vibe coding. I believe the tools have finally reached that critical threshold where they’re not just fun demos but genuinely practical for everyday use. And it looks like others feel the same!

Last time I felt as giddy as I do when vibe coding was my first ever visual basic app. Seismic shifts afoot people, seismic.

— Harry Brundage (@harrybrundage) • May 31, 2024

Programming with AI is what you thought programming would be like prior to learning it.

— Martin Casado (@martin_casado) • June 1, 2024

To build this data room app, I used Windsurf, an AI-assisted development platform founded in June 2021 by Varun Mohan and Douglas Chen. Originally launched as Exafunction (focusing on GPU optimization), the company pivoted to developer tools and rebranded as Codeium in 2022, before becoming Windsurf in April 2025.

For a comparison of coding agents, see ref 2, ref 3, ref 4, and ref 5. To understand how they work, see ref 6.

Observations and best practices

Now let’s get to the main point of this post. Below I share some observations I’ve made while using these tools over the past few months.

Observations

IDE interface. Interacting with LLMs directly inside an IDE is what makes the programming use case for LLMs so successful. Fast feedback loops while iterating on a project is key.

Skill issue. These tools increase the surface area of projects that I would take on. Everyone has their own areas of competency. I can rely on these tools to help me where I lack skills. This means I can take on brand new projects with more confidence.

Best practices

Version control and checkpoints. Version control is good in any situation, but specifically when working with agents that have write access to your codebase. This is not disimlar to how collaborating with a colleague is made practical via version control.

The agent sometimes changes already functional files and modules that are not relevant to your prompt. Sometimes it hallucinates and makes updates that are all wrong. Some say to lock a page you’re sure about; but practically you rarely want to lock a file in an evolving project, so the best bet is to have meaningful commits and checkpoints that you can revert to.

I would go so far to recommend you manage your git workflow manually. That way you can be sure you have meaningful checkpoints and ways to correct big mistakes and hallucinations. Otherwise you end up resetting a full day’s worth of work, which does happen.

Nudging. The agent sometimes does a local hacky solution rather than fixing the root cause. For example, instead of fixing a css issue globally, it might fix it locally for a specific part of the website, or separately for every part. On those occasions it requires nudging about best practices, for example, about separation of concerns. Otherwise, you’ll end up with unmaintainable code.

Code review. As I went deep into a couple of projects, spending more and more time on Windsurf, it had me wondering, am I getting good at anything? What skills, if any, am I gaining? When I program absent an agent, I get better at programming. When I write, I get better at writing When I vibe code, especially in a domain I’m not familiar with, am I actually learning anything? This is where I’d recommend reviewing every change before every commit. This way, you’ll not only have better command over your codebase but also learn from your robot friend.

Imprecise details. Being imprecise can be the source of a lot of pain. Be as clear as possible. English is code. I wasted a full half day due to imprecisely describing the folder structure in a project only to realize that it was my prompt and not the agent’s dumbness that was leading the project astray.

Technical details. I’ve found that the more accurate I can explain what I want and the more technical context I can provide, the faster and smoother things go.

TODO file. Aside from technically detailed prompts, it helps to have a well-defined project definition at the outset. The project goes smoother if there is a clear roadmap. A good TODO file not only helps keep track of tasks but can also serve as a reference to past prompts instead of the alternative of “as per my tenth to last prompt.”

Cold starts. Starting from a template is a great idea, when available. Starting from scratch can be challenging especially if you don’t know what the project structure should look like. Lack of templates isn’t necessarily a blocker but templates make the experience smoother and steer the agent towards best practices in domains where you are not as opinionated.

Debugging. Debugging works easier when you understand the codebase. For example, if I can identify the root cause of a bug, it’s easier to write a prompt and fix the problem. Otherwise, it’s just an endless loop of the blind leading the blind; which can still work but can take forever.

Work estimates. One thing I’ve struggled with is trying to estimate how long something takes. Is it easier or harder to provide work estimates with working with an agent? I’d say it’s harder. Imagine working with someone without having visibility into their strengths and weaknesses. In my experience I’ve found the agent is not great at auth flows, but really good at CSS, for example.

Pure vibes. If it’s a small, short-term project, it makes sense to let the agent take the wheel. All you need to do is to nudge it in the right direction once in while but little involvement is necessary. However, for a bigger project, or one that’s meant to be revised later, or one that is shared with other collaborators, it’s different. In this case it’s easier if you know the codebase and review every commit, just as you would if you were working with a colleague who might move to another project at any point. Additionally, if your project is one where performance or security matters then you need to be more alert and involved.

Memories and rules. A new chat window doesn’t always remember how we did things before and will find a new way of doing things, that while probably correct, is not consistent with the rest of the codebase. In these settings it makes sense to create a memory or a rule to guide the agent.

That’s it for now. I’ll add to this list as I learn more.

Product sneak peek

Here’s a sneak peek of what we have so far.

Next steps

Along with part 2 of this post where I’ll explain the login flow with magic link authentication, I will publish a link for you to take the data room app for a spin.

Next up, stay tuned as I share some of my explorations into MCP servers and agents.

If you have any feedback or advice, please let me know via X, Bluesky, or Medium. I’m looking forward to hearing from you.

References

¹ Papermark. (2023). “Best virtual data room providers comparison”.

^1b FirmRoom. (2023). “11 best data room providers you need in 2024: Comparison”.

² Yogesh, B. (2025). “AI coding tools: A developer’s head-to-head comparison”. A technical comparison of Cursor, GitHub Copilot, Replit, Cline, and Claude Code from an engineer’s perspective.

³ C# Corner. (2025). “Top 7 AI tools for software developers”. Comprehensive analysis of GitHub Copilot, ChatGPT, Replit AI, Windsurf, Tabnine, Cursor AI, and V0 by Vercel.

⁴ Kingy AI. (2025). “AI coding agents in 2025: Cursor vs. Windsurf vs. Copilot vs. Claude vs. VS Code AI”. In-depth analysis of strengths and weaknesses across code generation, debugging, refactoring, and large-codebase support.

⁵ BrightCoding. (2025). “AI coding assistants compared: technical benchmarks”. Technical analysis showing Windsurf processes 180 tokens/second with Llama 3.1 405B model, Cursor averages 220 tokens/second with GPT-4o, and GitHub Copilot processes 150 tokens/second with standard models. Engineers prefer Cursor (42%) for refactoring, Windsurf (38%) for speed and privacy, and Copilot (36%) for reliability.

⁶ Sourcegraph Engineering. (2024). “The anatomy of an AI coding assistant”. Technical blog explaining how modern AI coding assistants work under the hood, detailing the vector embedding techniques (using OpenAI’s text-embedding-ada-002 or custom models), context fetching mechanisms, and how different features (autocomplete, chat, test generation) use specialized retrieval methods optimized for latency (76ms) or accuracy depending on the use case.