¿Puedo vibecodear Qooling?

NO TANTO · sigue valiendo pagarlo

precio varíatiempo de build un fin de semanacategoría 🔐 seguridadreemplazada por 0 personas

You can absolutely build a register: incidents in, corrective actions out, documents with version numbers, a dashboard that looks convincing. What you cannot build in a session is the thing anyone actually buys, which is an evidence trail an external ISO auditor will accept without argument, plus a mobile flow that a warehouse worker will actually use to report a near miss. Compliance software lives or dies on immutable audit logs, controlled document approval with signatures, retention rules and the fact that the vendor, not you, is the one explaining the system during a certification audit. A personal replacement also makes little sense here: this is inherently multi-user, and the value appears only when an entire site logs into it. Build the register if you want to understand your own processes; do not put your certification on top of it.

el prompt

Build a self-hosted single-organisation QHSE register. This is a learning and internal-tracking tool, not a certification system, and it should say so on the dashboard.

Stack, no substitutions:
- Next.js (App Router) with TypeScript and Tailwind
- SQLite via Prisma, file at ./data/qhse.db
- Local disk storage for attachments under ./data/uploads
- Single shared password from AUTH_PASSWORD in .env, cookie session, no user accounts, no OAuth, no cloud services, no telemetry

Data model:
- Person: name, email, site
- Incident: type (incident, near miss, unsafe situation), date, site, reporter, description, severity 1-5, photos, status (open, investigating, closed)
- Risk: hazard, activity, likelihood 1-5, impact 1-5, computed score, existing controls, owner, review date
- Action: title, source (incident or risk or audit), owner, due date, status, closure note, closed date
- Document: title, code, current version number, category, owner, review date, uploaded file per version, status (draft, approved, retired)
- AuditLog: append-only table, every create and update writes actor, timestamp, entity, field-level before and after JSON. Never allow deletes on this table in application code.

Screens:
- Dashboard: open incidents, overdue actions, risks above score 15, documents past review date
- List and detail views for each entity, with inline forms, no modals-only flows
- Risk matrix view: 5x5 grid, colour by score, click a cell to see the risks in it
- Evidence pack: pick a date range, get a single printable HTML page with all incidents, actions, risks and document versions in it, plus the relevant audit log rows

In scope: seed script with two sites, five people, sample incidents and risks. CSV export for every list. Overdue highlighting.
Out of scope: mobile app, offline capture, email notifications, e-signatures, multi-tenant, ISO clause libraries, permissions and roles.

On the dashboard, print a fixed banner: "Internal tracking only. Not an audited compliance system."
Include README with setup, .env.example with AUTH_PASSWORD, and a backup script that copies ./data to a timestamped folder.

$ ábrelo en tu agente (prompt listo, tú das enter) o cópialo crudo

por qué la gente sigue pagando

Because compliance is a social process, not a data model. Getting fifty people across three sites to report incidents, sign off documents and close corrective actions requires a tool that everyone tolerates, a mobile app that works in a loading bay, and a paper trail that survives an auditor picking a random clause and asking for proof. Companies also pay for someone to blame: if the certification audit goes badly, a vendor with ISO-shaped templates and support is a better story than a spreadsheet-plus-side-project maintained by whoever built it before they left.

qué pierdes

xAuditor familiarity: external certification bodies have seen the commercial tools and know what to click

xImmutable, tamper-evident audit logging and controlled document sign-off, which is the whole point of the category

xA field-usable mobile app for incident and near-miss reporting with photos, offline

xPrebuilt ISO 9001 / 14001 / 45001 / 27001 templates, risk matrices and clause mappings you would otherwise write from scratch

xSomeone else being accountable when the system fails during an audit or a serious incident investigation

arte previo · úsalo en vez de construir, si prefieres

Nada que valga la pena señalar. Por eso existe el prompt.

compartir en X ↗"Acabo de reemplazar Qooling con un prompt"