Feedback Module

VibeKit collects product feedback and gives administrators a bounded triage surface. New submissions stay private until an administrator chooses what, if anything, to publish.

Overview

Users can submit ideas, bug reports, and general feedback from the widget. Administrators review submissions in the admin area. A public feedback board is optional and only shows items that were explicitly published.

Key Capabilities

• In-App Widget: Slide-over sheet accessible from the homepage, marketing pages, and the SaaS app shell.
• Categorization: Submissions tagged as Feature Request (FEATURE), Bug Report (BUG), or General (OTHER).
• Context Capture: Records a submitted page URL and an optional verified image attachment. A user can separately opt in to send a previewable diagnostic bundle.
• Operator Triage: Filter by status (OPEN, PLANNED, IN_PROGRESS, COMPLETED, DECLINED), search by title/description/user, and update status in real time.
• Rate Limiting: Submission and voting limits use server-derived account or network signals; a browser-supplied ID is never proof of identity.

Privacy and publication

Feedback reports, administrator replies, and attachments have separate publication controls. New submissions are private on all three controls. Publishing a report never publishes its reply or attachment, and a reply cannot be public until the report is public. Authors can see their own signed-in submission history; public visitors only receive the explicitly public fields.

The optional diagnostic bundle is off by default and can be reviewed before submission. It contains a sanitized page/reference URL, viewport and screen values, browser language and user agent, and up to 25 screened console warnings or errors. It excludes account identity and is not collected on authentication, reset, checkout, invitation, onboarding, settings, admin, or API routes.

When the public board is enabled, anonymous voting uses the first-party vibekit-feedback-voter cookie. It is an opaque, signed, host-only HttpOnly cookie with a one-year maximum age. It supports one browser vote and is not an account identity; account votes use the signed-in account instead.

Configuration

Enable or disable the feedback module in config.ts:

export const config = {
  // ...
  feedback: {
    enabled: true,
  },
};

When the resolved feedback module is disabled (the admin override takes precedence over config.feedback.enabled), the trigger widget is hidden on the homepage and in the app, the /app/admin/feedback route returns a 404, and the tRPC submission endpoint throws a FORBIDDEN error.