Naked Snail

When the tools changed, the market did not keep up

AI broke the economics of video production. One person with the right stack now ships what used to need a production house — and the moment that became true, everyone started claiming it. Brands cannot tell proof from hype. Good creators disappear into marketplaces holding ten thousand identical profiles.

The usual answer is a bigger marketplace with better search. That does not fix a trust problem; it scales it.

The bet: a small roster, and nothing hidden

Naked Snail is deliberately small and human-vetted, and it discloses what other marketplaces obscure. Every video states the exact AI tools that made it. Every creator publishes real rates up front. Every brief gets an answer inside 48 hours.

The name carries the argument, and so does the mascot: a snail without its shell.

What it is

Three products sharing one database.

For brands — browse vetted work by format, play it on hover, send a two-minute brief. No account, no agency markup.

For creators — sign up in under a minute, log in without a password, manage their own profile and rates, upload work straight to the CDN, and pass a verification review before appearing publicly.

For admins — an invite-only dashboard that reviews pending signups with inline video previews, verifies or unpublishes in one click, and sends branded email automatically at every step.

Security that lives in the database

The access rules are not in the application. They are in Postgres.

Row-Level Security decides what each role can see: the public role only ever sees verified creators, a creator can only edit their own row, admins are an email allowlist. The sensitive transitions run through SECURITY DEFINER functions, so the API surface is the database — and it is tested with SQL, per role.

The reason to build it this way is simple: a rule enforced in the application is a rule that a new endpoint can forget. A rule in the database cannot be forgotten.

Videos that never touch the server

Vercel caps request bodies at 4.5 MB, and video is not 4.5 MB.

So video never passes through the server at all. The server's only job is to sign an upload ticket for Bunny Stream, and the browser then uploads directly to the CDN in resumable chunks, with a real progress bar. The platform handles ten-minute videos on a hosting plan that refuses five-megabyte requests.

Playback got the same treatment. The obvious way to preview on hover — swap the iframe source — reloads the player every time and races anyone moving quickly. Instead each card loads its player once, muted and paused, and is driven through a postMessage handshake, so a hover that arrives before the player has booted still plays.

Sending an email exactly once

The welcome email goes out on a creator's first login, not at signup — the difference between greeting someone who showed up and someone who filled in a form.

That introduces a classic double-send: auth callbacks fire more than once. The fix is one atomic claim in the database — a single UPDATE … WHERE welcomed_at IS NULL, where the row count tells you whether you won the right to send. Nobody gets welcomed twice.

The snail is maths

The mascot crawls down a serpentine path as you scroll, leaning into its direction of travel, pulsing as it moves, turning around when you scroll back up, and weaving behind headings and cards through an occlusion mask.

It is one SVG silhouette reused everywhere — the scroll animation, the favicon, and the logo in the emails, rasterised to PNG at build time because Gmail strips SVG. Motion is driven by scroll velocity and respects prefers-reduced-motion throughout.

Built solo, for about ten euros a month

Product, brand, design, frontend, backend, database security, email deliverability, DNS and deployment — one person, alongside other work, from a static one-pager in May to a full self-service platform by September 2026. Total running cost is around ten euros a month.

It was built in pair-programming sessions with Claude Code: the migrations, the RLS test matrices, the DNS changes and the production verification. That is the same way we think about Webflow's move towards agentic tooling — not AI instead of engineering judgement, but AI applied with it.