Proven formats.
Scripts in seconds.
Viraling analyzes viral videos, extracts their skeleton and adapts it to your brand: reels, carousels and stories ready to shoot.
No signup. Opens a shared account with sample data.
3 free scripts per month, no card required
By creating an account you accept our Terms and Privacy Policy.
Viral format library
Formats extracted from videos with millions of views, ready to adapt to any niche.
Scripts in your brand voice
A brand questionnaire feeds every script: your tone, your offer, your CTA word.
Ready to record
Timed sections, on-screen text, 3 covers and a caption with hashtags. Export to PDF.
How this was built
A full stack SaaS, not a template. The parts worth looking at are the ones you cannot see from the screenshots.
Postgres row level security
Every table has RLS enabled and forced. The app connects as a dedicated role without BYPASSRLS and sets the user id per transaction, so one user physically cannot read another user's rows. Route handlers check ownership again on top.
Credit ledger with no bypass
Credits are debited inside the same transaction that writes the ledger row, with a conditional update that makes two simultaneous requests safe. If the AI call then fails, the credit is refunded. The balance is never written anywhere else in the code.
AI calls the user cannot steer
The Anthropic key is server only, enforced at build time. System prompts are fixed on the server and every piece of user text is wrapped as delimited data with an explicit instruction to treat it as content, never instructions. Output is validated with Zod before it is stored.
Rate limiting that degrades safely
Per user and per IP limits on the AI endpoints via Upstash Redis, falling back to an in memory window if Redis is unreachable. A provider outage weakens the limit but never takes the app down, because the hard spend ceiling is the credit ledger.
Hand rolled session auth
Email and password with bcrypt. The cookie carries a random 256 bit token and the database stores only its SHA-256, so reading the sessions table does not let you forge a login. Sign in takes the same time whether or not the account exists.
Server rendered PDF export
Every script exports as a production guide PDF, generated on demand server side with the same section colors and timings as the screen, and never stored.
Stack
Chosen for the constraints, not the resume.
Next.js 16
App Router, server components, route handlers
TypeScript
Strict mode, no any in app code
Postgres
Neon serverless, row level security
Drizzle ORM
Typed SQL, interactive transactions
Claude API
Script generation and format extraction
Zod
Every request and every AI response
Tailwind CSS
Own component kit, no UI dependency
Upstash Redis
Distributed rate limiting
Netlify
Deploy and scheduled functions
Vitest
Unit tests, plus scripted security checks