We had an agent replace Typeform in 26 minutes: the receipts

The setup

Question. If you hand the recipe's build packet (SPEC.md + AGENTS.md) to a coding agent, do you get something you could run instead of Typeform, and what does it miss?

Tested on. Stackcut's own intake forms: We need two real forms: "Request a recipe" and "Share your switch story" (testimonials with consent and private proof uploads).

How we tested

1. Gave a fresh coding agent only the packet, a one-page brief with our two forms, and a Typeform-format CSV to import. No other Stackcut files.
2. The agent chose the stack, wrote tests first, built the app and wrote a report.
3. A second, separate agent ran the app from the outside without trusting its tests: 12 black-box checks, a code review for security, and its own webhook receiver.
4. Checked the packet's "Check before building" item ourselves: does Tally's free plan already cover the Must-have list?

The numbers

Stackcut's own test, not a customer. Every figure links the lab report.

Agent build time

26 min

Agent wall-clock, measured. Not an estimate of human time.

Code written

2,251 + 1,271 lines

App plus tests. Stack: Node 22 built-ins: http, sqlite, crypto, test.

npm dependencies

0

Builder's own tests: 74 of 74 pass (re-run by us: 74 pass, 3.6 s).

Independent checks passed

12 of 12

A second, separate agent ran the app from the outside without trusting its tests.

Security issues the tests missed

1 medium, 6 low

Plus 6 informational findings.

Typeform import

252 of 252 cells

Rows: 12 of 12, including the partial response and two responses from one email. A second run added 0.

Software cost

$0 a month

Needs an always-on Node process with a disk. Stackcut runs on Vercel and Supabase, so this would need a small server or a port to Supabase. We didn't price a server.

The independent checks

• Forms render
• Submissions stored
• Conditional logic on the server
• Validation and uploads
• Signed webhook with retries
• CSV export
• Import without loss or duplicates
• Access
• Submitter delete
• Backup and restore
• Publishing gate
• Malformed input

From the lab report our test

What the outside review found

• Medium: unlimited admin-token guesses (300 in 186 ms) and no strength check beyond 16 characters.
• Low: logout doesn't end the admin session (valid for 12 hours).
• Low: deleted answers stay in the SQLite WAL file and older backups, while the page says they're removed.
• Low: database and backup files are world-readable (0644).
• Low: admin POSTs rely only on SameSite cookies; no CSRF token or Origin check.
• Low: uploads over about 22 MB get a connection reset instead of an error page.

From the lab report our test

What it costs against Typeform and Tally

List prices from each pricing page; the build's cost is from our test (Stackcut's own test, not a customer).

• Typeform Basic: $39/mo, with 100 responses a month and 1 user included. typeform.com
• Tally Free: no charge, unlimited submissions within fair use, and all 6 must-haves from our brief. Tally Pro at $24/mo adds custom domains, no branding and partial submissions. our test
• The agent-built app: $0 a month in software, but it needs an always-on Node process with a disk, which we didn't price. our test
• Modeled first-year saving of moving from Typeform Basic to Tally Free: $418, modeled, not measured. the math

What we found

• The packet works: one agent session produced a tested, dependency-free app that imported the Typeform export without loss and passed 12 of 12 independent checks.
• The agent's own tests weren't enough. 74 passing tests missed 1 medium and 6 low security issues that an outside check found in about 15 minutes. A build recipe must include an independent review step.
• For most people the build is the wrong path. Tally's free plan covers every Must-have. Building only pays off if you need something Tally doesn't do: data in your own database, a consent-and-approval gate before anything is published, or people deleting their own submissions.
• "Check before building" was pushed onto the builder, who couldn't look outside its folder. Stackcut should answer those checks before handing over the packet.
• File uploads are the migration trap. The agent imported them as links and said they'd die on cancel. A Typeform community thread says export file URLs download without a login, so an importer can fetch them. Either way: get the files before you cancel (also available as "File uploads only" ZIP).
• Hosting is the hidden cost. $0 in software, but you need somewhere to run it. For a Vercel/serverless stack that means a port, not a copy. our test

The verdict

Works, with caveats An agent can build this in under half an hour, and it works. Ship it only after an independent security check, and only if Tally's free plan fails a real requirement. For Stackcut it doesn't fail on features; it fails on keeping testimonial proof (invoices) out of a new processor.

What we changed in the recipe

The test changed the catalog. The current recipe is Branded intake and approval flow.

• The build packet now names the cheaper paths that already cover every Must-have (Tally free here) and tells the builder to stop and ask instead of deciding.
• The build path's playbook starts with "write down the requirement Tally's free plan fails; if you can't, use Tally".
• The packet now asks for concrete acceptance tests and adds tests for downloading files, real deletion, and restoring into a fresh location.
• The access test now covers public vs admin for apps without accounts.
• Every build packet now has a security checklist: admin brute-force limit, CSRF/Origin check, revocable sessions, file permissions, size limits, restore path validation.
• Every build packet now requires an outside check before real data, and names where the app runs and what that costs.
• Removed the duplicate Formbricks line under "Start from".

Receipts and disclosures

Evidence we kept

• Packet, brief and fixture: lab/form-intake-build/packet, BRIEF.md, fixtures/
• Builder report: lab/form-intake-build/app/REPORT.md
• Independent QA: lab/form-intake-build/qa/QA-REPORT.md with probe scripts and outputs

Disclosures

• Stackcut's own test on our own 2 forms (a recipe request form and a switch-story form with consent and private proof uploads), not a customer result. One run, on 2026-09-25. our test
• We wrote the build packet, so this tests our own spec as much as the agent. The agent got only the packet, a one-page brief and a Typeform-format CSV: no other Stackcut files. our test
• The test changed the recipe: every build packet now carries a security checklist and requires an outside check before real data. our test

FAQ

Keep reading

• Typeform alternatives in 2026: what to use instead, and what it really costs
• Keyword data per call vs a $139 Semrush seat: what we measured
• Zendesk and Intercom alternatives in 2026: what to use instead, and what it really costs
• Recipe: Branded intake and approval flow