BangerAI — Viral X Post Generator

Product Overview & Core Mission

BangerAI is a free web app that turns half-formed thoughts, news blurbs, or bullet points into a finished X (Twitter) post that reads like a real person wrote it — not a robot. The user pastes a rough draft, picks a tone and structure, and gets back a polished post in seconds, alongside a live X preview, a virality score, and a chat to refine the result in plain words.

The core problem: most AI writing tools produce text that instantly reads as machine-generated — em-dashes everywhere, stiff phrasing, and filler like "game-changer" or "in today's fast-paced world." BangerAI's mission is the opposite — take a proven viral-post structure and deliver it in a genuinely human voice, free, with no account, no credit card, and no privacy compromise.

Free vs. Unlimited (BYOK) Tiers

Every user falls into one of two tiers, and the app decides which simply by checking whether a key was pasted.

Free tier (no key needed): requests run on a server-side pool of the owner's Groq keys, so the tier is rate-limited per person by IP address (e.g. 10 generations per day) to keep shared costs in check.

Unlimited tier — BYOK (Bring Your Own Key): the user pastes their own free Groq key into Settings. Requests then run on their account with no rate limit from us, and the key is stored only in their browser, sent with each request, and never saved on our servers.

The Generation Pipeline & Model Rotation

The AI model is only ever called from the server — the browser never talks to Groq directly, which keeps the shared keys secret and lets the app enforce limits. A generate request flows through an edge API route that validates the input, then resolves the tier: a BYOK key skips rate limiting entirely, while the free tier passes through a per-IP rate-limit gate before drawing from the shared key pool.

To squeeze the most quality out of a limited key pool, generation uses a model-first, key-inner rotation strategy. For each model from best to weakest, it tries every key in the pool, advancing to the next key on a rate-limit or bad-key error and skipping to the next model only when a model is unavailable. The chain runs from llama-3.3-70b-versatile down to llama-3.1-8b-instant, so users get the strongest model their quota allows.

Deterministic 'Sounds Human' Post-Processing

The app's secret sauce is that it does not trust the model to "not sound like AI" — it fixes the output with code. After the full post is generated, a finalize step runs a deterministic clean-up pipeline in a fixed order.

The pipeline strips any leaked reasoning blocks, replaces AI tells (em-dashes become commas, filler phrases and label-colons are removed, bullets are normalized), optionally expands contractions for the raw human tone, splits the text to one sentence per line for the signature X-post look, flattens nested bullets, removes any link the model invented that was not in the original draft, and normalizes spacing into clean beats. The result reads like a person wrote it — every time, even when the model slips.

BYOK Security Model & Content-Security-Policy

A user's BYOK key lives only in their browser in localStorage, is sent with each request, used in memory on the server to call Groq, and then discarded — never stored or logged. It is held in plaintext by necessity: the page's own JavaScript must read the key to send it, so any encryption key would sit in that same readable code. Safety therefore comes from keeping hostile code off the origin, not from obscuring the value.

That guarantee is enforced by origin isolation, HTTPS with HSTS, the deliberate absence of HTML-injection sinks (no dangerouslySetInnerHTML, innerHTML, or eval), and a strict Content-Security-Policy whose connect-src 'self' blocks exfiltration to any other server. Server-side keys are read only from server env and never reach the browser bundle.

Rate Limiting, Virality Scoring & Live UX

The free tier is metered with Upstash Redis using a per-IP sliding window, split into three independent daily buckets so different actions never compete: generate, refine, and virality each get their own limit. If the rate-limit database is not configured, production fails closed rather than handing out shared keys unmetered.

The virality score runs on the Node runtime and uses forced tool-calling to return structured data validated by a Zod schema — four sub-scores (readability, hook, body, closer) plus suggestions, with the overall score computed on the server as their average so it is always consistent. On the front end, a live free-count badge stays honest by reading the real remaining count from a response header after each generation, and the studio adds a device-accurate live preview, one-click PNG export drawn on a canvas, and a cross-tab history strip.