SecurityCAN I VIBECODE
RoboForm?
BUILD FIRST
- A non-sensitive or read-only version of the core experience
- A manual review step wherever correctness or trust matters
- A narrow companion tool that removes a real piece of work
LEAVE FOR LATER
- Regulated decisions, payments, or irreversible actions
- Claims of correctness, compliance, or uptime that the MVP cannot support
- Sensitive integrations until security, support, and auditability are ready
RESEARCH NOTES
What this tool actually does.
RoboForm is a commercial password manager and form-filling application by Siber Systems, available for Windows, macOS, iOS, Android, and major browsers. It stores unlimited passwords, identities, Safenotes, and bookmarks locally or in the cloud with AES-256 encryption and PBKDF2-SHA256, using a zero-knowledge architecture where the master password never leaves the device. Core features include one-click login and form filling, a password generator, password auditing for weak/duplicate/compromised passwords, data breach monitoring for up to five emails, secure sharing via public-private key encryption, shared folders, emergency access, a built-in TOTP authenticator, passkey management, passwordless unlock via device biometrics/PIN, offline access, CSV/browser import/export, Windows application login, and 2FA options including SMS, authenticator apps, and hardware keys. The free tier cover
RESEARCHED BUILD PROMPT
Give this to your coding agent.
Build a focused replacement for RoboForm's core workflow: a local-first password manager with one-click login and web form filling. The product should be called by a new name and must not copy RoboForm branding, logo, color scheme, or UI layout; design an original interface. Workflow: user creates a master password, the app generates and stores strong unique passwords per site, auto-detects login fields, fills credentials with a click, generates passwords during signup, and audits existing passwords for weakness or known breaches. Include an identity/profile system to fill address or payment forms with one click. Must support offline use, AES-256 encryption of the vault with PBKDF2 key derivation, and zero-knowledge sync via optional encrypted cloud storage. Use a browser extension plus a desktop app architecture: the extension injects fill logic, the desktop app manages vault backups, CSV import/export, password audit, and a TOTP authenticator for manual 2FA codes. Implement secure sharing between users via asymmetric keys and an emergency-access mechanism with a waiting period. Include passkey storage as a stretch goal. Explicitly out of scope: data breach monitoring of email addresses, Windows application login, bookmark management, and a family/admin console. Do not claim tested security certifications. Deliver a README covering setup, vault format, sync protocol choice, known limitations, and a disclaimer that the replacement is not affiliated with RoboForm.