Most use of the vibrate API will obviously be malicious if it's implemented without spam prevention; otherwise I won't be able to disable the feature fast enoug

Most use of the vibrate API will obviously be malicious if it's implemented without spam prevention; otherwise I won't be able to disable the feature fast enough. The only way this could be workable is if there were something like an HTML meta tag for requesting vibrate support for scripts running from your domain, and that would prompt a one-time dialog to white-list that domain for vibrate support in JS.