DEV Community: Sora2 Hub Team

Supabase RLS Checklist for AI-Built Next.js Apps

Sora2 Hub Team — Fri, 30 Oct 2026 13:01:02 +0000

AI coding agents are good at scaffolding a Next.js app with Supabase Auth and a few tables. They are less reliable at locking those tables down. If Row Level Security (RLS) is missing or too loose, every signed-in user can read everyone else's rows.

Use this checklist before you put a preview or production URL in front of customers.

1. Turn RLS on for every user-facing table

In the Supabase dashboard (or a migration), confirm RLS is enabled on profiles, projects, documents, billing_customer, and any table that stores tenant data. A table with RLS off is public to the anon/authenticated roles that have GRANTs.

2. Prefer `auth.uid()` policies over client-side filters

Client .eq('user_id', user.id) is not security. The API still returns other rows if a policy allows it. Policies should look like:

SELECT / UPDATE / DELETE: auth.uid() = user_id (or auth.uid() = owner_id)
INSERT: WITH CHECK (auth.uid() = user_id)

3. Never expose the service role key in the browser

The service role bypasses RLS. Keep it on the server only (Route Handlers, Server Actions, Edge Functions). If an AI agent put SUPABASE_SERVICE_ROLE_KEY in a NEXT_PUBLIC_ env var, rotate the key and remove it from the client bundle.

4. Test with two real accounts

Create user A and user B. As A, create a row. As B, try to fetch it by ID and by list query. Both should fail (empty list / 0 rows / 403). Repeat for update and delete.

5. Watch storage buckets

If you store uploads, bucket policies need the same owner checks. A public bucket with guessable paths leaks files even when table RLS is correct.

6. Avoid SECURITY DEFINER surprises

AI agents sometimes wrap queries in a Postgres function marked SECURITY DEFINER so it can "just work". That function runs as the owner and can bypass RLS unless you re-check auth.uid() inside it. Prefer SECURITY INVOKER (Postgres 15+) or keep RLS-aware SQL in policies, not in privileged helpers.

7. Stripe webhooks and admin jobs

Webhook handlers often need the service role. Scope those writes tightly (update only the customer/subscription row for that stripe_customer_id) and keep the handler server-side.

8. Check GRANTs, not only policies

RLS policies only apply to roles that can touch the table. If anon or authenticated still have broad GRANT ALL, a missing policy fails open for that role. Prefer least privilege: grant SELECT/INSERT/UPDATE/DELETE only where needed, then layer RLS. After AI scaffolding, run \dp public.* (or the dashboard Privileges view) and revoke anything the client roles should not have.

Pre-deploy mini plan

RLS enabled on all tenant tables
Policies use auth.uid() with WITH CHECK on inserts
No service role in client env
Two-user isolation test passed
Storage policies reviewed
No unsafe SECURITY DEFINER helpers bypassing RLS
Webhook path uses service role only on the server
Client-role GRANTs reviewed (least privilege)

Ship when all eight are green.

Where Massvai helps

Massvai is an AI full-stack Next.js app builder. Use it to scaffold faster, then run this checklist yourself before you ship. Agents draft policies; humans verify them.

Supabase Auth dans le middleware Next.js : 6 erreurs fréquentes (et comment les corriger)

Sora2 Hub Team — Sat, 17 Oct 2026 16:11:05 +0000

Le middleware de Next.js est l'endroit naturel pour rafraîchir la session Supabase et rediriger les visiteurs non connectés. C'est aussi là que naissent les bugs les plus agaçants : déconnexions aléatoires, boucles de redirection, pages protégées qui s'affichent quand même. Voici les six erreurs que l'on rencontre le plus souvent avec l'App Router.

1. Utiliser encore les anciens « auth helpers »

Le paquet @supabase/auth-helpers-nextjs est déprécié. La méthode actuelle passe par @supabase/ssr, qui fournit createServerClient (serveur, middleware) et createBrowserClient (composants client). Mélanger les deux paquets dans un même projet donne des cookies incompatibles et des sessions qui disparaissent.

npm install @supabase/supabase-js @supabase/ssr

2. Ne pas renvoyer les cookies rafraîchis

Quand le jeton d'accès expire, Supabase le renouvelle et écrit de nouveaux cookies. Si le middleware ne les recopie pas sur la réponse, le navigateur garde l'ancien jeton et l'utilisateur est déconnecté au bout d'une heure. Le client doit écrire à la fois sur la requête et sur la réponse :

// middleware.ts
import { createServerClient } from '@supabase/ssr'
import { NextResponse, type NextRequest } from 'next/server'

export async function middleware(request: NextRequest) {
  let response = NextResponse.next({ request })

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll() {
          return request.cookies.getAll()
        },
        setAll(cookiesToSet) {
          cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
          response = NextResponse.next({ request })
          cookiesToSet.forEach(({ name, value, options }) =>
            response.cookies.set(name, value, options))
        },
      },
    }
  )

  const { data: { user } } = await supabase.auth.getUser()

  if (!user && request.nextUrl.pathname.startsWith('/dashboard')) {
    const url = request.nextUrl.clone()
    url.pathname = '/login'
    return NextResponse.redirect(url)
  }

  return response
}

3. Glisser du code entre `createServerClient` et `getUser()`

La documentation de Supabase insiste : n'exécutez pas de logique entre la création du client et l'appel à auth.getUser(). Un await sur autre chose à cet endroit peut faire perdre le rafraîchissement du jeton, et l'on obtient des déconnexions difficiles à reproduire. Créez le client, appelez getUser(), puis seulement ensuite décidez de la redirection.

4. Faire confiance à `getSession()` côté serveur

getSession() lit la session depuis les cookies sans la revalider : un cookie modifié à la main passerait le contrôle. Dans le middleware, les Server Components et les Route Handlers, utilisez getUser(), qui vérifie le jeton auprès de Supabase Auth. Gardez getSession() pour le client, où il sert surtout à l'affichage.

5. Un `matcher` trop large

Sans configuration, le middleware tourne sur chaque requête, y compris les fichiers statiques et les images optimisées. Chaque appel ajoute un aller-retour vers Supabase et ralentit tout le site. Excluez ce qui n'a pas besoin de session :

export const config = {
  matcher: [
    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
  ],
}

Et si vous redirigez vers /login, vérifiez que /login ne redirige pas à son tour : c'est la cause classique de la boucle infinie.

6. Croire que le middleware protège les données

Le middleware protège la navigation, pas la base. Une requête faite directement avec la clé anon contourne entièrement vos redirections. Activez Row Level Security sur chaque table exposée et écrivez des politiques basées sur auth.uid(). Considérez le middleware comme une amélioration de l'expérience utilisateur, et RLS comme la vraie barrière de sécurité.

En résumé

@supabase/ssr à la place des anciens helpers, cookies recopiés sur la réponse, getUser() appelé immédiatement et utilisé côté serveur, un matcher qui ignore les fichiers statiques, et RLS partout. Avec ces six points, l'authentification se comporte de la même façon en local et en production sur Vercel.

Transparence : cet article est écrit par l'équipe de Massvai, un générateur d'applications par IA qui crée des projets full-stack Next.js, Supabase et Vercel. Les conseils s'appliquent à n'importe quel projet, que vous utilisiez notre outil ou non.

Supabase Realtime en Next.js (App Router): 5 errores comunes y cómo evitarlos

Sora2 Hub Team — Sat, 17 Oct 2026 11:28:08 +0000

Supabase Realtime permite que una app de Next.js reciba cambios de la base de datos al instante: un chat, un tablero de pedidos o un contador de notificaciones. Funciona muy bien en local, pero al pasar a producción aparecen siempre los mismos problemas. Estos son los cinco que más vemos y su solución.

1. Suscribirse desde un Server Component

Realtime abre un WebSocket en el navegador. Un Server Component se ejecuta una vez en el servidor y no mantiene conexiones, así que la suscripción nunca llega al cliente. La suscripción debe vivir en un componente con 'use client', y los datos iniciales pueden venir del servidor como props.

'use client'
import { useEffect, useState } from 'react'
import { createBrowserClient } from '@supabase/ssr'

export function Pedidos({ iniciales }: { iniciales: Pedido[] }) {
  const [pedidos, setPedidos] = useState(iniciales)

  useEffect(() => {
    const supabase = createBrowserClient(
      process.env.NEXT_PUBLIC_SUPABASE_URL!,
      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
    )
    const canal = supabase
      .channel('pedidos')
      .on('postgres_changes',
        { event: 'INSERT', schema: 'public', table: 'pedidos' },
        (payload) => setPedidos((p) => [payload.new as Pedido, ...p]))
      .subscribe()

    return () => { supabase.removeChannel(canal) }
  }, [])

  return <ul>{pedidos.map((p) => <li key={p.id}>{p.titulo}</li>)}</ul>
}

2. Olvidar limpiar el canal

Sin removeChannel en el cleanup del useEffect, cada navegación o recarga en caliente crea un canal nuevo. El resultado son eventos duplicados y, con el tiempo, el límite de conexiones del proyecto alcanzado. Limpia siempre el canal al desmontar.

3. No activar la publicación de la tabla

Por defecto las tablas no emiten cambios. Hay que añadirlas a la publicación supabase_realtime (en el panel: Database, Publications, o con SQL):

alter publication supabase_realtime add table public.pedidos;

Si no llega ningún evento y no hay errores en consola, casi siempre es esto.

4. Esperar eventos que RLS bloquea

Realtime respeta las políticas de Row Level Security. Si el usuario no puede hacer select sobre una fila, tampoco recibirá su evento. Es lo correcto por seguridad, pero confunde cuando las políticas solo cubren insert. Revisa que exista una política de lectura para las filas que el cliente debe ver.

5. Filtrar en el cliente en lugar de en el canal

Recibir todos los cambios de la tabla y filtrarlos en JavaScript gasta ancho de banda y expone datos innecesarios. Usa el parámetro filter del canal:

{ event: '*', schema: 'public', table: 'mensajes', filter: `sala_id=eq.${salaId}` }

Resumen

Suscripción solo en cliente, limpieza del canal, tabla añadida a la publicación, políticas de lectura correctas y filtros en el servidor. Con eso, Realtime se comporta igual en Vercel que en local.

Aviso: escribimos esto desde el equipo de Massvai, un generador de apps con IA que crea proyectos full-stack con Next.js, Supabase y Vercel. Los consejos sirven para cualquier proyecto, uses o no nuestra herramienta.

How to Keep a Character Consistent Across AI-Generated Images and Clips

Sora2 Hub Team — Sat, 17 Oct 2026 02:56:03 +0000

You generate a great character in one image. Then you ask for the same person in a kitchen, at night, from the side, and you get a cousin. Different jawline, different jacket, different hair. Character drift is the most common complaint from people making storyboards, short ads or comic panels with AI.

The good news is that most drift comes from a handful of fixable habits. This guide walks through a workflow that keeps a character recognizable from the first still to the final animated clip.

1. Write a character sheet before you write a scene

Most people describe the character inside every scene prompt, slightly differently each time. The model treats each wording change as a new instruction.

Instead, write one fixed block of text and paste it unchanged into every prompt:

Mira: woman in her late 20s, short black bob with blunt bangs, round tortoiseshell glasses, mustard-yellow raincoat, small silver hoop earrings, calm expression.

Rules for a good sheet:

Five to eight visual anchors. Hair, eyewear, one signature garment, one accessory, age range, build.
Concrete nouns, not vibes. "Mustard-yellow raincoat" survives; "quirky artsy style" does not.
Never edit it mid-project. If you must change something, start a new version and regenerate the reference.

2. Lock a reference image first

Generate the character alone on a plain background, front-facing, neutral light. Make a few variations and pick one. This is your master reference.

From then on, use image-to-image or reference-image mode for every new shot instead of pure text-to-image. Text alone gives the model too much freedom; a reference image pins the face and outfit.

A useful trick is a simple turnaround: front, three-quarter and side views generated from the master. Having all three makes later angles far more stable.

3. Separate "who" from "where"

Structure each scene prompt in two parts:

The unchanged character sheet.
The scene: location, action, camera angle, lighting.

[Character sheet]. Scene: she is sitting at a café window on a rainy evening, holding a paper cup, medium shot, warm interior light, rain streaks on the glass.

When drift happens, you only ever edit part two. That makes problems easy to isolate.

4. Change one variable at a time

Moving the character to a new place, a new pose, new lighting and a new lens in one step almost guarantees drift. Change the location first and keep the pose simple. Once that works, change the lighting. Then the angle.

It feels slower, but it's faster than regenerating twenty images that are all slightly wrong.

5. Watch the usual drift triggers

Extreme close-ups and wide shots. Faces drift most at the edges of the framing range. Medium shots are the safest.
Heavy style words. "Oil painting", "anime" or "cinematic" can override facial features. Pick a style once and keep it in the sheet.
Busy backgrounds. Crowds and patterned walls pull detail away from the character.
Hands holding new objects. Props are fine, but introduce them one at a time.

6. Animate from your best stills, not from text

When you move to video, start from a still you already approved. Image-to-video keeps the face and outfit far better than generating the clip from a text prompt.

Keep the motion prompt about motion only:

Slow push-in. She lifts the cup and looks out the window. Face, glasses and raincoat stay unchanged; no new people appear.

Short clips (3 to 5 seconds) drift less than long ones. If you need a longer sequence, chain several short clips, each starting from an approved frame.

7. Keep a project log

A plain text file with the character sheet, the master reference, and the exact prompts that worked saves hours. When a client asks for "one more shot of Mira", you can reproduce her in minutes.

A simple workflow to copy

Write the character sheet.
Generate and pick a master reference plus a turnaround.
Build each scene with reference mode, editing only the scene half of the prompt.
Approve stills.
Animate approved stills into short clips.
Log what worked.

Tools

Any generator with reference-image and image-to-video support can run this workflow. If you want image generation and video generation in one place, Sora2 Hub is an AI image and video generator that lets you create the stills and animate them without switching apps.

Consistency isn't magic. It's mostly discipline: one fixed description, one locked reference, and one change at a time.

Déployer une app Next.js + Supabase sur Vercel : la checklist en 8 points

Sora2 Hub Team — Sun, 11 Oct 2026 18:43:52 +0000

Votre app marche en local, npm run dev ne renvoie aucune erreur… et la version en production affiche une page blanche. C'est presque toujours l'un des huit points ci-dessous. Gardez cette liste sous la main avant chaque mise en ligne.

1. Les variables d'environnement sont dans le bon environnement

Sur Vercel, une variable peut être définie pour Production, Preview ou Development. Vérifiez que NEXT_PUBLIC_SUPABASE_URL et NEXT_PUBLIC_SUPABASE_ANON_KEY existent bien pour Production, puis relancez un déploiement : une variable ajoutée après le build n'est pas prise en compte.

2. La clé `service_role` ne sort jamais du serveur

Elle contourne toutes les règles RLS. Ne lui donnez jamais le préfixe NEXT_PUBLIC_, utilisez-la uniquement dans des Route Handlers ou des Server Actions, et jamais dans un composant client.

3. RLS est activé sur chaque table exposée

Une table sans Row Level Security est lisible par n'importe qui possédant la clé anon, c'est-à-dire tout visiteur. Dans le tableau de bord Supabase, activez RLS et écrivez au moins une politique select basée sur auth.uid().

4. Les URL de redirection d'authentification incluent le domaine de production

Dans Authentication > URL Configuration, ajoutez https://votre-domaine.com/** et, si vous utilisez les previews, https://*-votre-equipe.vercel.app/**. Sinon, les liens magiques et l'OAuth renvoient vers localhost.

5. Les cookies de session sont gérés côté serveur

Avec l'App Router, utilisez @supabase/ssr et un middleware qui rafraîchit la session. Sans cela, l'utilisateur semble connecté sur le client mais anonyme dans les Server Components.

6. Les migrations sont appliquées sur la base de production

Les tables créées à la main en local n'existent pas forcément en ligne. Versionnez le schéma avec supabase migration new et appliquez-le avec supabase db push avant de déployer le code qui en dépend.

7. Les images distantes sont autorisées

Si vous affichez des fichiers du Storage Supabase avec next/image, déclarez l'hôte *.supabase.co dans images.remotePatterns de next.config.js.

8. Les fonctions ne dépassent pas le délai

Les traitements longs (génération, export, e-mails en masse) dépassent vite la durée maximale d'une fonction serverless. Déplacez-les dans une file ou une Edge Function Supabase et renvoyez immédiatement une réponse.

Pour aller plus vite

Si vous partez de zéro, un générateur d'applications peut créer cette base pour vous. Massvai est un générateur d'applications IA qui produit des apps full-stack Next.js, Supabase et Vercel dont vous gardez le code ; la checklist ci-dessus reste valable pour relire ce qu'il génère.

Transparence : je fais partie de l'équipe Massvai.

How to Write a Spec an AI App Builder Can Actually Ship

Sora2 Hub Team — Sun, 11 Oct 2026 16:14:22 +0000

How to Write a Spec an AI App Builder Can Actually Ship

AI app builders can now produce a working full-stack app from a description. The catch is the description. "Build me a CRM" gets you a pretty demo with fake data. A short, structured spec gets you something close to a real product.

Here's the spec format that consistently produces usable Next.js apps on the first or second try.

Why vague prompts fail

An AI builder has to make hundreds of decisions: data model, auth, routes, validation, empty states. Every decision you leave out, it guesses. Guesses compound. By the time you notice the data model is wrong, three screens are built on top of it.

A spec doesn't need to be long. It needs to answer the questions the builder would otherwise guess.

The one-page spec

1. One sentence on who it's for and what they do

A booking tool for independent yoga teachers to publish class times and let students reserve a spot.

This single line decides tone, layout and which features matter.

2. Users and roles

List each role and what it can do:

Teacher: creates classes, sees bookings, cancels classes.
Student: browses classes, books, cancels own booking.
No admin panel in v1.

Saying what's out of scope is just as useful as what's in.

3. Data model in plain words

Teacher has many Classes. Class has title, start time, duration, capacity, price. Student has many Bookings. Booking belongs to one Class and one Student; status is booked or cancelled.

You don't need SQL. Nouns, relationships and key fields are enough for the builder to produce a sane schema.

4. The three to five core flows

Write each as steps:

Student opens a teacher's public page, sees upcoming classes.
Student picks a class, signs in with email, confirms booking.
Teacher sees the booking count update on their dashboard.

If a flow isn't listed, assume it won't be built well.

5. Rules and edge cases

This is where most generated apps break:

A class can't be booked past capacity.
A student can't book the same class twice.
Cancelling within 12 hours of start is not allowed.
All times are shown in the viewer's timezone.

6. Stack and integrations

If you have preferences, state them: Next.js App Router, Postgres, email magic-link auth, Stripe Checkout for paid classes. If you don't, say "use sensible defaults" so the builder doesn't invent something unusual.

7. What "done" looks like

Done when a teacher can create a class and a student can book and cancel it end to end, with capacity enforced.

This gives the builder, and you, a clear test.

Iterate in small steps

After the first build, resist rewriting the whole spec. Ask for one change at a time:

"Add a waitlist when a class is full."
"Send the teacher an email when a booking is cancelled."

Small requests keep the existing structure intact. Big rewrites tend to regenerate working parts and break them.

Check the boring parts

Before you show anyone the app, test:

Empty states (no classes yet).
Error states (payment declined, invalid input).
A second account, to confirm users can't see each other's data.

These are the places AI-generated code is most likely to cut corners.

A template to copy

Product: [one sentence]
Roles: [role: can do X, Y; out of scope: Z]
Data: [nouns, relationships, key fields]
Core flows: [3 to 5 numbered flows]
Rules: [limits, permissions, edge cases]
Stack: [preferences or "sensible defaults"]
Done when: [one end-to-end test]

Where to try it

Paste the template into any AI app builder. If you want a full-stack Next.js app with database and auth generated from a spec like this, Massvai is an AI full-stack app builder built for exactly that workflow.

The better your spec, the less you fight the generator. One page of clear decisions beats fifty follow-up prompts.

Supabase RLS for a Next.js SaaS: The 7 Policies You Actually Need

Sora2 Hub Team — Sat, 10 Oct 2026 16:59:51 +0000

"new row violates row-level security policy" is probably the most common error people hit on their first Supabase + Next.js app. It usually shows up right after you enable RLS, which is the correct thing to do. The fix is almost never "turn RLS off". You need a small, predictable set of policies and a client that actually sends the user's JWT.

This is the checklist I use for a typical multi-tenant SaaS: users, profiles, workspaces, members and app data.

First: how RLS decides

RLS on with no policies means nobody gets in (except the service role). That's why inserts suddenly fail after you flip the switch.
Each operation needs its own policy. A select policy does not allow insert, and an update policy does not cover upsert inserts.
using filters existing rows; with check validates new or changed rows. Inserts only use with check. Updates use both.
PostgREST returns the inserted row by default. If you have an insert policy but no matching select policy, the insert can fail on the return step. Add a select policy or call .insert(row, { returning: 'minimal' }) (in supabase-js v2, just don't chain .select()).
Grants still apply. A missing grant raises 42501 before any policy runs.

The 7 policies

1. Profiles: read your own

create policy "profiles: read own"
on public.profiles for select
to authenticated
using ((select auth.uid()) = id);

Wrapping auth.uid() in (select ...) lets Postgres cache it per statement, which matters on large tables.

2. Profiles: created by a trigger, not the client

Don't insert profile rows from onAuthStateChange in the browser. Use a trigger on auth.users:

create function public.handle_new_user()
returns trigger language plpgsql security definer set search_path = public as $$
begin
  insert into public.profiles (id) values (new.id);
  return new;
end; $$;

create trigger on_auth_user_created
after insert on auth.users
for each row execute procedure public.handle_new_user();

No client insert policy is needed, which is one less thing to get wrong.

3. Profiles: update your own, can't change owner

create policy "profiles: update own"
on public.profiles for update
to authenticated
using ((select auth.uid()) = id)
with check ((select auth.uid()) = id);

4. Membership helper

Most SaaS data belongs to a workspace, not a user. Put the membership check in one security definer function so policies stay short and you avoid recursive policies on the members table:

create function public.is_member(ws uuid)
returns boolean language sql stable security definer set search_path = public as $$
  select exists (
    select 1 from public.workspace_members
    where workspace_id = ws and user_id = auth.uid()
  );
$$;

5. Workspace data: read and write if member

create policy "projects: member read"
on public.projects for select to authenticated
using (public.is_member(workspace_id));

create policy "projects: member insert"
on public.projects for insert to authenticated
with check (public.is_member(workspace_id));

create policy "projects: member update"
on public.projects for update to authenticated
using (public.is_member(workspace_id))
with check (public.is_member(workspace_id));

6. Owner-only delete

Deletes are where accidents happen. Restrict them to owners:

create policy "projects: owner delete"
on public.projects for delete to authenticated
using (exists (
  select 1 from public.workspace_members m
  where m.workspace_id = projects.workspace_id
    and m.user_id = (select auth.uid())
    and m.role = 'owner'
));

7. Storage objects

Storage uploads are inserts into storage.objects followed by a returning. You need insert and select:

create policy "avatars: upload own folder"
on storage.objects for insert to authenticated
with check (bucket_id = 'avatars' and (storage.foldername(name))[1] = (select auth.uid())::text);

create policy "avatars: read own folder"
on storage.objects for select to authenticated
using (bucket_id = 'avatars' and (storage.foldername(name))[1] = (select auth.uid())::text);

The Next.js side: make sure the JWT arrives

Half of "RLS is broken" reports are really "the request was anonymous".

In the App Router, use @supabase/ssr and createServerClient with cookie getAll/setAll in Server Components, Route Handlers and middleware. Don't mix it with the old auth-helpers package.
In middleware, write refreshed cookies to both the request and the response, or the next request will look logged out.
Call supabase.auth.getUser() on the server, not getSession(), when you make auth decisions.
Never ship the service role key to the browser. If something only works with the service role, that's a missing policy, not a reason to use the service key.

Test policies, don't eyeball them

Put pgTAP tests in supabase/tests/ and run supabase test db. For each table, assert:

anon can't select, insert, update or delete
a member can do what they should
a non-member gets zero rows on select and 42501 on insert
an update can't move a row to another workspace

One catch: a denied update filtered by using raises nothing. It just matches zero rows. Assert with returning and check the result, or your test will pass on a write that never happened.

Generated code still needs this

If you scaffold apps with an AI builder, check the generated migrations against this list before launch. Tools that output a real Next.js + Supabase codebase, like Massvai, make that easy because you can read and edit the SQL. Whatever generated it, the rule is the same: one policy per operation, a membership helper, and tests.

Quick debugging order

Is RLS enabled and are the grants there?
Is there a policy for this exact operation?
Does the insert also need a select policy for returning?
Is the request authenticated? Log auth.uid() with select auth.uid() from the same client.
Does with check match the values you're actually sending, for example user_id?

Get those five right and the error mostly goes away.

Camera Motion Prompts for AI Image-to-Video: A Practical Cheat Sheet

Sora2 Hub Team — Sat, 10 Oct 2026 06:35:00 +0000

Most weak image-to-video clips fail for the same reason: the prompt describes the picture again instead of describing the movement. The model can already see your image. What it needs from you is how the camera moves, what moves inside the frame, and what must stay still.

This cheat sheet collects the camera moves that work reliably, the wording that tends to produce them, and the mistakes that cause warping and drift.

The three-part motion prompt

A good image-to-video prompt usually answers three questions, in this order:

Camera: How does the camera move? (push in, orbit, pan, static)
Subject: What moves in the scene? (hair in the wind, steam rising, a person turning their head)
Constraints: What must not change? (the logo, the face, the product shape, the background)

Example:

Slow push-in toward the cup. Steam rises gently from the coffee. The cup, label and table stay unchanged; no new objects appear.

Short and specific beats long and poetic. If you write a paragraph of adjectives, the model spends its effort on style instead of motion.

Camera moves that work well

Move	Prompt wording	Best for
Push-in	"slow push-in toward the subject"	Product hero shots, portraits, reveals
Pull-out	"slow pull-back revealing the room"	Showing context or scale
Orbit	"camera orbits 90 degrees around the subject, smooth"	Products, sculptures, characters
Pan	"slow pan left across the scene"	Landscapes, wide interiors
Tilt	"camera tilts up from the shoes to the face"	Fashion, full-body shots
Static	"locked-off static camera"	When only the subject should move
Handheld	"subtle handheld movement"	Casual, UGC-style social clips
Dolly zoom	"dolly zoom, background stretches"	Dramatic moments (use sparingly)

Two tips that apply to all of them:

Say the speed. "Slow" and "smooth" reduce jitter. Fast moves amplify every artifact.
Use one camera move per clip. "Push in, then orbit, then pan up" in a five-second clip almost always breaks. If you need several moves, generate several clips and cut them together.

Subject motion: keep it small

Small, physical motions look natural: blinking, breathing, fabric moving, water rippling, leaves swaying, light flickering. Large actions (running, dancing, turning around fully) are where faces and hands fall apart.

If a character needs to do something big, consider giving the model an end frame as well as a start frame, if your tool supports it. Anchoring both ends of the clip keeps identity much more stable.

Constraints: tell the model what to protect

This is the part people skip, and it matters most for commercial work. Useful constraint phrases:

"the product shape and label stay unchanged"
"the face stays consistent, no morphing"
"background remains still"
"no text, no new objects"

Not every model follows negative instructions equally well, so check the output frame by frame anyway, especially logos and hands.

Common mistakes

Re-describing the image. "A red sneaker on a white background" adds nothing. Describe motion.
Conflicting moves. "Static camera, slow orbit" confuses the model.
Low-resolution input. Compression artifacts become flicker once the image moves. Start from the sharpest original you have.
Busy source images. Lots of small details (text, patterns, crowds) tend to warp. Simpler compositions animate more cleanly.
Judging one take. The same prompt can produce very different results. Generate three or four variations before you rewrite anything.

A quick workflow

Pick or generate a clean first frame (an image model helps if you need a new setting).
Write the three-part prompt: camera, subject, constraints.
Generate a few short variations with the same prompt.
Change one variable at a time: speed, move, or constraint wording.
Try the same prompt on a second video model; models differ a lot in how they handle motion.

Comparing models without juggling accounts

Step 5 is where most people give up, because every model lives behind a different account and billing page. Sora2 Hub is an AI image and video generator that puts several image and video models behind one credit balance, so you can run the same motion prompt on two or three models and compare the clips side by side.

Copy-paste starter prompts

Product: "Slow 90-degree orbit around the bottle on a marble surface. Soft light glints on the glass. Bottle shape and label stay unchanged."
Portrait: "Locked-off static camera. She blinks and smiles slightly; hair moves in a light breeze. Face stays consistent."
Landscape: "Slow pan right across the valley. Clouds drift, grass sways. No people appear."
Food: "Slow push-in toward the bowl. Steam rises, sauce glistens. Bowl and table stay still."
Interior: "Slow pull-back from the sofa revealing the whole living room. Curtains move gently."

Start with these, change one thing at a time, and keep the camera move simple. That alone fixes most bad clips.

v0 Alternatives for Full-Stack Next.js Apps

Sora2 Hub Team — Fri, 09 Oct 2026 13:06:26 +0000

v0 is a strong Next.js tool. If you want a different setup for backend, hosting, billing or workflow, here are the alternatives worth testing and what each one is built around.

Quick answer: If you need a full-stack Next.js app and want something other than v0, look at four options. Massvai generates a Next.js 15 + TypeScript app with Supabase and Stripe in the stack, syncs to GitHub, deploys to your Vercel project, and exports every file. Bolt supports many JavaScript frameworks including Next.js, with hosting and databases on Bolt Cloud. Replit Agent works with any framework and hosts the app on Replit with a built-in PostgreSQL database. Lovable is a capable full-stack builder, but it doesn't generate Next.js. New apps use TanStack Start, so it only fits if Next.js isn't a hard requirement. Pick based on where you want the database and hosting to live.

First: what v0 already does well

It's worth being precise, because many "alternatives" lists understate v0. According to Vercel's docs, v0 builds with Next.js, React, TypeScript, Tailwind CSS and shadcn/ui. It can import existing GitHub repos, Vercel projects or ZIP files, syncs with GitHub in both directions, and publishes through pull requests that respect required checks. Since early 2026, previews run in Vercel Sandbox, so server code, API routes and database connections work in the preview. Databases and services come from Vercel Marketplace integrations such as Neon, Supabase and Upstash, and Stripe is available as an integration.

So people usually look elsewhere for workflow reasons, not missing features:

They want a fixed, opinionated SaaS stack (auth + database + billing) generated from the first prompt, rather than assembled from integrations.
They want the builder itself to host everything, including the database, outside Vercel.
They prefer a different pricing model. v0 combines a plan with usage credits, priced per user on team plans.
They want frameworks beyond Next.js in the same tool.

Comparison table

From each vendor's official site and documentation, checked October 2026. Plans change, so confirm details before you buy.

	v0 (reference)	Massvai	Bolt	Replit Agent	Lovable
Next.js	Default	Default (Next.js 15)	One of many JS frameworks	Any framework	Not offered (TanStack Start for new apps)
Database	Marketplace integrations (Neon, Supabase, Upstash…)	Supabase	Bolt Cloud database or Supabase	Built-in managed PostgreSQL (separate dev and production DBs)	Lovable Cloud or Supabase
Payments	Stripe integration	Stripe in the stack	Stripe via Bolt Cloud	Ask the agent to integrate	Built-in payments or Stripe
Hosting	Vercel	Your Vercel project	Bolt Cloud, Netlify, others via GitHub	Replit (Autoscale or Reserved VM)	Lovable hosting; self-host possible
GitHub	Two-way sync, PR-based publish	GitHub sync	Sync, branches, import repos	Check Replit's docs	Git sync (new repos only)
Code export	Yes	Every file	Via GitHub or download	Check Replit's docs	ZIP on paid plans; Git sync on all
Pricing unit	Plan + usage credits	Credits per agent generation	Tokens	Check Replit's pricing page	Credits per workspace

Massvai: an opinionated Next.js + Supabase + Stripe starting point

Massvai is an AI coding agent built around a single stack: Next.js 15, TypeScript and Tailwind, with Supabase for auth and data and Stripe for payments. You describe the product, optionally with a screenshot or reference file. The agent plans before it builds, then writes the code while you watch a live preview. When you're done, you sync the repo to GitHub and deploy to Vercel through a guided flow.

How it differs from v0: both produce Next.js and deploy to Vercel. v0 is open-ended and assembles services through Marketplace integrations. Massvai starts from a full SaaS shape (auth, database, billing-ready UI) built on Supabase. Every file is exportable, so the result is a standard Next.js + Supabase repo you can keep developing elsewhere.

Pricing: credits per agent generation. The Free plan includes 100 welcome credits with live preview and code export. Builder is $25/month (1,500 credits). Pro is $49/month (4,000 credits) and adds Supabase setup help, version history and priority support.

Good fit if: you're a founder or small team building a SaaS MVP or internal tool and want Supabase specifically.

Consider something else if: you need a non-Supabase database, a framework other than Next.js, or deep work inside a large existing repo. v0 and Bolt both import existing repositories.

Bolt: framework flexibility with built-in hosting

Bolt's docs describe support for JavaScript web technologies, with Node.js on the backend and a choice of JavaScript frontend frameworks. You can ask for Next.js, but it isn't the only path. New projects host on Bolt Cloud, which Bolt says is powered by Netlify and Supabase and covers hosting, domains, databases, auth, storage and server functions. Bolt can also generate Expo mobile apps when you ask for a mobile app in your first prompt. It syncs with GitHub, supports branches and imports existing repos.

Pricing: token-based. Bolt notes that larger projects use more tokens per message because project files are sent to the AI. Its pricing page lists a free tier, Pro from $25/month, and Teams per member.

Good fit if: you want one tool for several frameworks or a mobile companion app, and you're happy with hosting on Bolt Cloud. Bolt's docs say it doesn't support Python or PHP backends.

Replit Agent: any framework, hosted on Replit

Replit's docs describe its General Agent as working with any framework or language. It can do research and file generation, connect to services like BigQuery, Linear and Slack, and build full-stack apps. Every Replit App comes with a managed PostgreSQL database, and published apps get a separate production database. Full-stack apps built with Agent publish to Autoscale (the default) or Reserved VM deployments, not static hosting.

Good fit if: you want the build environment, database and hosting all in one place, or your project mixes Next.js with other languages.

Consider something else if: you specifically want deployments in your own Vercel account or a Supabase backend.

Lovable: a full-stack builder if Next.js is negotiable

Lovable is often listed as a v0 alternative, and it's a strong product, but its own FAQ says you can't choose Next.js. New apps (since May 13, 2026) use TanStack Start, and older apps use React + Vite. It includes Lovable Cloud (managed PostgreSQL, auth, storage), built-in payments on paid plans, hosting on lovable.app, and Git sync on any plan. Pricing uses workspace credits rather than per-seat fees.

Good fit if: you care more about getting a hosted app quickly than about the framework.

Not a fit if: your team, hiring plan or existing code requires Next.js.

How to choose

Is Next.js a hard requirement? If yes, your shortlist is v0, Massvai, and Bolt or Replit (both possible, but not their default).
Where should the database live? Vercel Marketplace (v0), Supabase (Massvai, also an option in Bolt and Lovable), Bolt Cloud, or Replit's built-in Postgres.
Where should the app run? Your own Vercel account (v0, Massvai), the builder's cloud (Bolt, Replit, Lovable), or anywhere via GitHub.
New project or existing repo? For existing repos, v0 and Bolt both document repo import.
How will you pay? Credits, tokens and per-seat plans aren't directly comparable. Estimate based on how many iterations your project needs.

A simple test

Write one product brief, for example "a team task tracker with auth, a Postgres-backed board, and a paid Pro plan", and give it to your top two picks. Compare four things: does it run, is the auth and database setup secure (check RLS or equivalent access rules), can you push it to your GitHub, and would you be comfortable maintaining the code six months from now? That last question usually decides it.

Sources: v0 docs, FAQ and pricing page; Massvai homepage; Bolt pricing page and support docs (supported technologies, Bolt Cloud, GitHub); Replit docs (General Agent, deployment types, SQL database, development and production databases); Lovable docs FAQ and pricing page. Checked October 2026.

Best AI Video Generators in 2026: Which Model for Which Job

Sora2 Hub Team — Fri, 09 Oct 2026 13:00:32 +0000

Best AI Video Generators in 2026: Which Model for Which Job

An honest look at the leading AI video models, what each one does well, where it falls short, and who it suits.

Quick answer: No single AI video model wins at everything in 2026, so pick by job. Google Veo 3.1 suits cinematic clips with native audio. Kling 3.0 suits multi-shot scenes up to 15 seconds. ByteDance Seedance 2.0 suits heavy reference-driven work. MiniMax Hailuo 2.3 suits affordable, motion-heavy clips. Alibaba Wan 2.7 suits prompt-based video editing. For stills and thumbnails, Nano Banana Pro and GPT Image 2 are the main options.

How to choose a model

Decide what you actually need first: native audio or not, one shot or several, consistent references (product, logo, character), output resolution and aspect ratio, and cost per usable clip. A cheap generation isn't cheap if you rerun it five times.

All the specs below come from each vendor's own documentation or announcement. Vendors update their models often, so check them again before you commit a budget.

The video models

Google Veo 3.1: cinematic shots with native audio

Strengths. Google describes Veo 3.1 as generating video with natively generated audio, including dialogue, sound effects and ambient sound. The Gemini API docs list 720p, 1080p and 4K output at 24 fps, in 16:9 or 9:16. Veo 3.1 supports text-to-video, image-to-video, first-and-last-frame transitions and reference images. Scene extension lets you continue a Veo clip to build longer sequences.

Limits. Base clips are 4, 6 or 8 seconds, so longer pieces depend on extension. In the Gemini API, extension works only on 720p Veo-generated video. Google's docs also note that higher resolutions take longer and that 4K costs more.

Best for: brand films, cinematic B-roll, and short ads where synced sound matters and you want to direct the camera.

Kling 3.0 (Kuaishou): multi-shot storytelling up to 15 seconds

Strengths. Kuaishou launched the Kling AI 3.0 series in February 2026: Video 3.0, Video 3.0 Omni, Image 3.0 and Image 3.0 Omni. According to Kling's guides, Video 3.0 adds native audio in several languages, dialects and accents, multi-shot storyboarding, element references for keeping characters consistent, and flexible clip lengths from 3 to 15 seconds. Kuaishou also highlights better preservation of text in the frame, such as signage and logos, and gives e-commerce ads as an example.

Limits. The Video 3.0 Omni guide lists 1080p and 720p modes, and credit cost depends on your inputs and clip length. Plan for 1080p delivery rather than native 4K video.

Best for: short narrative content, dialogue scenes, and product ads where a logo or character must stay readable and consistent across shots.

Seedance 2.0 (ByteDance Seed): the reference-heavy option

Strengths. Seedance 2.0 is built on what ByteDance calls a unified multimodal audio-video joint generation architecture. It accepts four kinds of input: text, image, audio and video. ByteDance says one generation can combine up to 9 images, 3 video clips and 3 audio clips with natural-language instructions. The model can borrow composition, camera movement, motion and sound from those references. ByteDance's launch post also mentions multi-shot audio-video output up to 15 seconds, stereo audio, and video extension and editing.

Limits. Setting up a prompt with many inputs takes more work, and it's at its best when you have reference assets. ByteDance's performance claims come from its own internal benchmark, so test it on your own content.

Best for: music-synced edits, outfit-change and product-showcase videos, and anyone who wants to copy a specific camera move or motion style from an existing clip.

Hailuo 2.3 (MiniMax): motion and value

Strengths. MiniMax built Hailuo 2.3 on Hailuo 02, with better body movement, physical realism, facial micro-expressions and response to motion instructions. It also improves support for anime, illustration, ink-wash and game-CG styles. A Hailuo 2.3 Fast variant generates faster at a lower price, and MiniMax publishes per-clip pay-as-you-go prices on its API pricing page.

Limits. MiniMax's API docs list 768P clips at 6 or 10 seconds and 1080P clips at 6 seconds only. That's shorter and lower-resolution than some competitors. Check whether the version you use generates audio, and plan to add sound in editing if it doesn't.

Best for: e-commerce sellers and social teams making many short clips, stylized and anime content, and dance or action scenes where motion quality matters most.

Wan 2.7 (Alibaba): editing video with prompts

Strengths. Alibaba launched Wan2.7-Video in April 2026 as four models: text-to-video, image-to-video, reference-to-video and video editing. It generates 2 to 15 seconds at 720p or 1080p. Its standout feature is editing with plain-language instructions: you can change actions, dialogue, appearance, scenes, style or camera work in an existing clip. Alibaba says it keeps up to five characters consistent across videos.

Limits. Wan 2.7 is offered as a hosted service through Alibaba Cloud Model Studio and the Wan website. If you chose Wan because earlier versions had openly downloadable weights, check which versions are actually open before you plan a self-hosted pipeline.

Best for: creators who iterate on existing footage, and teams that want to change one element of a clip without regenerating everything.

The image models (for thumbnails, key art and product shots)

Most video projects also need stills, for thumbnails, key art and first frames for image-to-video. Two image models cover most of that work.

Nano Banana Pro (Gemini 3 Pro Image)

Google positions Nano Banana Pro as its studio-quality image generation and editing model. Google highlights accurate, legible text inside images in multiple languages, controls for localized edits, camera angle, focus, lighting and color, and output at 1K, 2K or 4K. Images include SynthID watermarking.

Best for: posters, thumbnails, infographics and localized ad creatives where the text has to be right, plus high-resolution first frames for image-to-video.

GPT Image 2 (OpenAI)

OpenAI describes GPT Image 2 (gpt-image-2) as its state-of-the-art model for fast, high-quality image generation and editing, with flexible image sizes, high-fidelity image inputs and inpainting.

Best for: creators who liked OpenAI's style of prompt understanding and want quick concept art, product mockups and edits to existing images.

Quick comparison

Model	Type	What it's good at	Main limit to plan around	Good fit for
Veo 3.1	Video	Native audio, up to 4K, frame control	4–8 s base clips; extension at 720p	Cinematic ads, B-roll
Kling 3.0	Video	Multi-shot, 3–15 s, multilingual audio	1080p/720p modes	Narrative shorts, product ads
Seedance 2.0	Video	Mixed image/video/audio references	Prompt setup takes more work	Music-synced, reference-driven edits
Hailuo 2.3	Video	Motion, expressions, styles, Fast tier	6–10 s; 1080P only at 6 s	High-volume social and e-commerce
Wan 2.7	Video	Prompt-based video editing, 2–15 s	Hosted; check which versions have open weights	Iterating on existing clips
Nano Banana Pro	Image	Legible text, up to 4K	Image only	Thumbnails, posters, first frames
GPT Image 2	Image	Fast generation and editing, inpainting	Image only	Concepts, mockups, edits

Who should use what

Solo creators and YouTubers: Start with Veo 3.1 or Kling 3.0 for hero shots, and use Nano Banana Pro for thumbnails.
Marketers and agencies: Use Kling 3.0 or Seedance 2.0 when you need brand consistency across several shots. Veo 3.1 is a good choice when the client wants 4K.
E-commerce sellers: Hailuo 2.3 Fast and Kling 3.0 are worth testing for product videos at volume. GPT Image 2 or Nano Banana Pro can handle the product stills.
Editors iterating on footage: Wan 2.7's prompt-based editing can save full regenerations.

Most teams end up with two or three models, and the hidden cost is switching between them: separate accounts, separate billing, and different prompt habits.

Testing several models without juggling subscriptions

The most reliable way to choose is to run the same prompt and the same reference image through a few models, then compare usable clips per dollar rather than looks alone.

If you'd rather not open several separate accounts, Sora2 Hub is an AI image and video generator that offers many models, including Veo 3.1, Kling, Seedance 2.0, Hailuo, Wan, Nano Banana Pro and GPT Image 2, on one credit balance. That makes side-by-side tests and mixed workflows easier, such as a Nano Banana Pro first frame animated with Kling or Veo.

Bottom line

There's no single best AI video generator. Veo 3.1, Kling 3.0, Seedance 2.0, Hailuo 2.3 and Wan 2.7 each lead on a different job. Test two or three of them on your own prompts and reference images, and build your workflow around the results.

Sources: Google Gemini API Veo documentation; Kuaishou/Kling AI 3.0 announcement and model guides; ByteDance Seed Seedance 2.0 launch post; MiniMax Hailuo 2.3 announcement and API docs; Alibaba Cloud Wan2.7-Video announcement; Google DeepMind Nano Banana Pro page; OpenAI GPT-Image-2 model page. Specs were checked in October 2026 and may change.

Seedance 2.0 vs Kling 3.0 vs Veo 3.1: Which AI Video Model for Which Job

Sora2 Hub Team — Fri, 09 Oct 2026 12:54:37 +0000

Three leading video models compared on what their makers document: inputs, length, resolution, audio and control. Then matched to real jobs rather than ranked.

Quick answer: None of the three wins at everything. Veo 3.1 (Google) is the strongest choice for short, high-resolution single shots: clips are 4 to 8 seconds with native audio, up to 4K, with first/last-frame control and up to three reference images. Kling 3.0 (Kuaishou) is built for short stories: multi-shot clips from 3 to 15 seconds, native audio in several languages, and reusable "elements" that keep a character or product consistent. Seedance 2.0 (ByteDance) is the reference-heavy option. It takes text, images, video and audio together (up to 9 images, 3 videos and 3 audio clips, ByteDance says) and outputs multi-shot clips up to 15 seconds. Pick by job, then test on your own material.

Why "which is best?" is the wrong question

All three vendors publish impressive demos, and ByteDance and Google both describe strong results on their own evaluations. Those are vendor claims, measured by the vendors. No independent benchmark covers all three on the same prompts. What you can compare reliably is what each model accepts and produces, because that's documented. Those specs decide which jobs a model can do at all. Quality on your content is something you have to test.

Side-by-side specs

From each vendor's official documentation, checked October 2026. Plans and API tiers may expose only some of these options.

	Veo 3.1	Kling 3.0	Seedance 2.0
Maker	Google DeepMind	Kuaishou (Kling AI)	ByteDance Seed
Inputs	Text, image, first + last frame, up to 3 reference images, Veo video for extension	Text, image, start + end frames, element references (images; video in 3.0 / 3.0 Omni)	Text, image, video and audio together: up to 9 images, 3 videos, 3 audio clips
Clip length	4, 6 or 8 s (8 s required at 1080p/4K or with references); extension adds 7 s per step	3–15 s, flexible	Up to 15 s
Multi-shot in one generation	No (build sequences via extension or editing)	Yes: automatic or custom multi-shot	Yes
Resolution	720p, 1080p, 4K (extension at 720p only)	720P, 1080P, 4K listed for 3.0 and 3.0 Omni in Kling's API capability map	Not stated in the launch post; check your provider
Native audio	Always on (dialogue, effects, ambience)	Yes, multilingual, with dialects and accents	Yes, dual-channel stereo
Editing / extension	Scene extension of Veo clips	Separate tools for multi-element editing and lip sync	Video extension and targeted editing
Aspect ratios	16:9, 9:16	Check your plan or provider	Check your provider

Veo 3.1: the single hero shot

What it does well. Google's Gemini API docs describe Veo 3.1 as generating 8-second videos at 720p, 1080p or 4K with natively generated audio, at 24 fps. You get three kinds of control. Image-to-video animates a starting image. First-and-last-frame generation interpolates between two images you supply. Up to three reference images preserve the look of a person, character or product.

What to plan around. Base clips top out at 8 seconds. Longer pieces come from extension, which in the Gemini API works only on Veo-generated 720p video, adds 7 seconds per step, and requires the source video to have been created or referenced in the last two days. Google notes that higher resolutions mean longer waits and that 4K costs more.

Google's Gemini API docs now also recommend Gemini Omni Flash as the default video model for many workflows, and point to Veo 3.1 for scene extension, last-frame control and existing pipelines. If you build on Google's API, check both.

Best jobs: cinematic B-roll, hero product shots, short ads where one beautiful, well-lit 8-second shot with synced sound is the deliverable, and anything that needs 4K.

Kling 3.0: short stories with consistent characters

What it does well. Kling's model guide describes Video 3.0 as combining native audio, element consistency and multi-shot storytelling. You can let the model plan shots automatically, or use Custom Multi-Shot to set each shot's duration, framing, angle and camera movement. Clips run from 3 to 15 seconds. Native audio supports Chinese, English, Japanese, Korean and Spanish, plus dialects and accents.

The Element Library is the key feature for brand work. An element is a reusable asset built from 2–4 reference images. In 3.0 Omni, it can also be built from a short character video and carry a bound voice, so the same character or product looks and sounds consistent across generations. Kuaishou also points to better preservation of on-screen text such as signage and logos.

What to plan around. Multi-shot prompts take more planning than one-line prompts. Kling lists several variants (3.0 Turbo, 3.0, 3.0 Omni) with different capabilities. Turbo, for example, doesn't support element control in the capability map, so check which variant your plan or provider uses.

Best jobs: narrative social content, dialogue scenes, recurring characters or mascots, and multi-angle product ads in a single generation.

Seedance 2.0: when you have references to follow

What it does well. ByteDance describes Seedance 2.0 as a unified multimodal audio-video model that accepts four input types at once. Its launch post says you can combine up to 9 images, 3 video clips and 3 audio clips with a text instruction. The model can take composition, camera movement, motion rhythm, visual effects and sound from those references, and even follow a storyboard image. It outputs multi-shot clips up to 15 seconds with stereo audio, and supports video extension and targeted editing of clips, characters and actions.

What to plan around. It works best when you bring assets. A text-only prompt doesn't use its main strength. ByteDance's own launch post lists remaining weaknesses: detail stability, multi-subject consistency, text rendering accuracy and occasional audio distortion. ByteDance also notes that using real people's portraits as references requires identity verification or authorization.

Best jobs: music-synced edits, recreating a camera move or choreography from a reference clip, storyboard-to-video, and outfit or product showcases built from several angles.

Which model for which job

Job	First choice	Also test
8-second hero shot for a brand film, 4K delivery	Veo 3.1	Kling 3.0
15-second social ad with three different shots	Kling 3.0	Seedance 2.0
Recurring mascot or presenter across a series	Kling 3.0 (elements)	Veo 3.1 (reference images)
Copy the camera move from a reference video	Seedance 2.0	—
Edit cut to an existing music track	Seedance 2.0	Kling 3.0
Product photo → simple animated packshot	Veo 3.1 or Kling 3.0	Seedance 2.0
Dialogue in Japanese, Korean or Spanish	Kling 3.0	Veo 3.1
Turn a storyboard image into a sequence	Seedance 2.0	Kling 3.0 (custom multi-shot)

How to run a fair test

Fix the inputs. Use the same reference image, the same prompt (adjusted only for syntax), and the same aspect ratio and duration where possible.
Generate several takes per model. One sample tells you very little.
Score usable clips. Count a clip as usable only if it needs no regeneration: correct product, stable faces, believable physics, clean audio.
Track cost per usable clip. Prices differ by model, resolution and duration, so the cheapest generation isn't always the cheapest result.
Repeat in a month. All three vendors ship updates frequently.

Running a test like this is easier from one account. Sora2 Hub is a credit-based multi-model studio with Seedance 2.0, Kling 3.0 and Veo 3.1 (plus Hailuo, Wan and image models such as Nano Banana Pro and GPT Image 2) on a single credit balance. You can send the same prompt to all three and compare results without three subscriptions.

Bottom line

Choose Veo 3.1 for polished single shots and 4K, Kling 3.0 for multi-shot stories and consistent characters, and Seedance 2.0 when your references (images, video, music) should drive the result. Many teams keep two of the three and switch per brief.

Sources: Google Gemini API documentation (Veo 3.1 and video generation overview); Kling VIDEO 3.0 model guide, Kling Element Library guide and Kling API video capability map; ByteDance Seed "Seedance 2.0 Official Launch" (Feb 12, 2026). Checked October 2026. Capabilities vary by plan and provider, so confirm before production.

How to Build a SaaS MVP with Next.js, Supabase and Stripe Using an AI Agent

Sora2 Hub Team — Fri, 09 Oct 2026 12:48:50 +0000

A practical plan for using an AI coding agent to scaffold a subscription SaaS, plus the auth, database and billing details you still need to check yourself.

Quick answer: Write a one-page spec first: users, the one core workflow, the data tables and the paid plan. Have an AI agent scaffold the Next.js app with Supabase auth and a Stripe subscription flow, then review four areas yourself. (1) Server code checks the user with supabase.auth.getClaims() (or getUser()), never getSession(). (2) Row Level Security is enabled on every table in an exposed schema. (3) The Stripe webhook verifies signatures against the raw request body and handles duplicate and out-of-order events. (4) Secret keys never reach the browser. Then deploy to Vercel with separate test and live environment variables.

Step 1: Scope the MVP before you prompt

AI agents are fast, so scope creep is cheap to start and expensive to maintain. Write down:

Who signs up: individuals, or teams with multiple members?
The one workflow worth paying for: for example, "upload a CSV, get a cleaned report, download it".
Data: three to six tables at most, such as profiles, projects, reports, subscriptions.
Plans: one free tier and one paid tier is enough to test willingness to pay.
Out of scope: admin panels, teams, usage-based billing, i18n. Add them after real users ask.

This spec becomes your first prompt.

Step 2: Write a prompt the agent can execute

Name the stack, the pages and the rules. Leave visual polish for later. For example:

Build a Next.js App Router app in TypeScript with Tailwind. Use Supabase for email/password and magic-link auth and for the database. Tables: profiles (id = auth user id), projects (owner_id, name, created_at), subscriptions (user_id, stripe_customer_id, stripe_subscription_id, status, price_id, current_period_end). Enable RLS on all tables so users can only read and write their own rows. Pages: landing, pricing, login, dashboard (list and create projects), settings (manage billing). Use Stripe Checkout in subscription mode for one "Pro" monthly price, and the Stripe customer portal for plan changes and cancellation. Add a webhook route that verifies the Stripe signature and updates subscriptions. Gate project creation beyond 3 projects behind an active subscription, checked on the server.

Ask the agent to plan first and show you the file structure and SQL migration before writing everything. Fixing a plan is much cheaper than fixing code.

Step 3: Review authentication

Supabase's Next.js server-side auth guide uses the @supabase/ssr package with cookie-based sessions. Two things to check in what the agent generates:

Verify the user on the server properly. Supabase's docs say to use supabase.auth.getClaims() to protect pages and user data. It verifies the access token's signature. You can also call getUser() for a fresh, server-confirmed user record. The docs also say never to trust supabase.auth.getSession() in server code, because it reads the session from a cookie without revalidating it, and cookies can be forged.
Session refresh runs in middleware. The Supabase guide refreshes the auth token in middleware (Next.js 16 renamed middleware to "Proxy"). In Next.js 15, cookies() is async, so the server client is created with await.

Also check that protected routes redirect anonymous users on the server, not only in client components.

Step 4: Review the database and Row Level Security

This is the most important review step. Supabase's RLS guide is blunt: a table in an exposed schema without RLS is readable and writable by any role with a grant on it. Enable RLS on every table in an exposed schema.

Check the generated migration for:

alter table ... enable row level security; on every table, including tables added later.
Policies scoped to auth.uid(): for example, projects rows where owner_id = auth.uid().
Views: Supabase notes that views bypass RLS by default because they are usually created by the postgres user. Don't expose a view over a protected table unless it's made safe.
Secret key usage: the secret (service role) key bypasses RLS. Supabase says never to use it in the browser. Use it only in server code such as the webhook handler.

Then test as a real user: create two accounts and confirm neither can see the other's data through the API.

Step 5: Review Stripe billing

The standard flow is: Checkout (subscription mode) → webhook updates your subscriptions table → your app reads that table to grant access → the customer portal handles upgrades and cancellation.

Stripe's webhook documentation covers what agents most often get wrong:

Verify every event. Use the Stripe-Signature header and your whsec_ signing secret. Without verification, Stripe warns, attackers could send fake events to grant access.
Use the raw body. Stripe requires the unmodified raw request body for signature verification. In a Next.js route handler, read it with await request.text() and don't parse JSON first.
Return 2xx quickly, before slow work, to avoid timeouts.
Handle duplicates. Endpoints can receive the same event more than once, so log processed event IDs and skip repeats.
Don't assume order. Stripe doesn't guarantee event order. Fetch the current subscription from the API when in doubt, rather than trusting the sequence.

For subscriptions, Stripe's docs describe customer.subscription.created, .updated (renewals, plan changes, discounts) and .deleted (subscription ends). On invoice.paid, Stripe recommends confirming the subscription status is active before extending access. Handle invoice.payment_failed too, so access lapses cleanly.

To test locally, run stripe listen --forward-to localhost:3000/api/webhooks/stripe (adjust to your route). The CLI prints a signing secret for local use.

Step 6: Deploy

Push the code to GitHub.
Import the repo into Vercel and set environment variables: Supabase URL and publishable key (public), Supabase secret key and Stripe secret and webhook secret (server-only, no NEXT_PUBLIC_ prefix).
Create a live-mode webhook endpoint in Stripe pointing at your production URL, and use its own signing secret.
Add your production URL to Supabase Auth's redirect settings so magic links and OAuth return to the right domain.
Run one real subscription with a live card, then cancel it through the portal and confirm access is removed.

Where an AI agent helps, and where it doesn't

An agent removes most of the boilerplate: routing, forms, dashboard UI, the Supabase client setup, the migration skeleton and the Checkout and portal routes. It doesn't remove your responsibility for security and money. RLS policies, webhook verification and server-side access checks are where a plausible-looking bug costs real data or revenue. Read those files line by line.

This is the workflow Massvai is built around. Its AI coding agent turns a prompt into a full-stack Next.js 15 + TypeScript app with Supabase and Stripe in the stack, shows the build in a live preview, syncs the repo to GitHub, and deploys to your own Vercel project through a guided flow. You can export every file, so you can run the review checklist below in your own editor.

Pre-launch checklist

[ ] Server code uses getClaims() / getUser(), never getSession(), for access decisions
[ ] RLS enabled on every exposed table; policies tested with two accounts
[ ] No views exposing protected tables
[ ] Supabase secret key and Stripe secrets are server-only
[ ] Webhook verifies signatures against the raw body
[ ] Duplicate events skipped by event ID; no dependence on event order
[ ] Access granted only for active subscriptions; failed payments handled
[ ] Customer portal linked from settings
[ ] Separate test and live keys, webhooks and redirect URLs

Sources: Supabase docs ("Setting up Server-Side Auth for Next.js", "Row Level Security"); Stripe docs ("Receive Stripe events in your webhook endpoint", "Using webhooks with subscriptions"); Next.js docs (Proxy file convention, version history); Massvai homepage. Checked October 2026.

DEV Community: Sora2 Hub Team

Supabase RLS Checklist for AI-Built Next.js Apps

1. Turn RLS on for every user-facing table

2. Prefer auth.uid() policies over client-side filters

3. Never expose the service role key in the browser

4. Test with two real accounts

5. Watch storage buckets

6. Avoid SECURITY DEFINER surprises

7. Stripe webhooks and admin jobs

8. Check GRANTs, not only policies

Pre-deploy mini plan

Where Massvai helps

Supabase Auth dans le middleware Next.js : 6 erreurs fréquentes (et comment les corriger)

1. Utiliser encore les anciens « auth helpers »

2. Ne pas renvoyer les cookies rafraîchis

3. Glisser du code entre createServerClient et getUser()

4. Faire confiance à getSession() côté serveur

5. Un matcher trop large

6. Croire que le middleware protège les données

En résumé

Supabase Realtime en Next.js (App Router): 5 errores comunes y cómo evitarlos

1. Suscribirse desde un Server Component

2. Olvidar limpiar el canal

3. No activar la publicación de la tabla

4. Esperar eventos que RLS bloquea

5. Filtrar en el cliente en lugar de en el canal

Resumen

How to Keep a Character Consistent Across AI-Generated Images and Clips

1. Write a character sheet before you write a scene

2. Lock a reference image first

3. Separate "who" from "where"

4. Change one variable at a time

5. Watch the usual drift triggers

6. Animate from your best stills, not from text

7. Keep a project log

A simple workflow to copy

Tools

Déployer une app Next.js + Supabase sur Vercel : la checklist en 8 points

1. Les variables d'environnement sont dans le bon environnement

2. La clé service_role ne sort jamais du serveur

3. RLS est activé sur chaque table exposée

4. Les URL de redirection d'authentification incluent le domaine de production

5. Les cookies de session sont gérés côté serveur

6. Les migrations sont appliquées sur la base de production

7. Les images distantes sont autorisées

8. Les fonctions ne dépassent pas le délai

Pour aller plus vite

How to Write a Spec an AI App Builder Can Actually Ship

How to Write a Spec an AI App Builder Can Actually Ship

Why vague prompts fail

The one-page spec

1. One sentence on who it's for and what they do

2. Users and roles

3. Data model in plain words

4. The three to five core flows

5. Rules and edge cases

6. Stack and integrations

7. What "done" looks like

Iterate in small steps

Check the boring parts

A template to copy

Where to try it

Supabase RLS for a Next.js SaaS: The 7 Policies You Actually Need

First: how RLS decides

The 7 policies

1. Profiles: read your own

2. Profiles: created by a trigger, not the client

3. Profiles: update your own, can't change owner

4. Membership helper

5. Workspace data: read and write if member

6. Owner-only delete

7. Storage objects

The Next.js side: make sure the JWT arrives

Test policies, don't eyeball them

Generated code still needs this

Quick debugging order

Camera Motion Prompts for AI Image-to-Video: A Practical Cheat Sheet

The three-part motion prompt

Camera moves that work well

Subject motion: keep it small

2. Prefer `auth.uid()` policies over client-side filters

3. Glisser du code entre `createServerClient` et `getUser()`

4. Faire confiance à `getSession()` côté serveur

5. Un `matcher` trop large

2. La clé `service_role` ne sort jamais du serveur