Observed
Service state, nginx routing, systemd configuration, source excerpts, database backend, effective runtime flags.
Overview
How Real Video Creator works
A technical view of the deployed system and the work still ahead.
This presentation focuses on the Real Video Creator architecture observed in a read-only September 24, 2026 VPS/source audit. Real Gamers is a separate native media effort, disclosed as a technical capability and possible future upsell: not a shipped RVC integration.
RVC
Operating web, export and voice services in September snapshot
$0
Confirmed paid subscriptions in October 21 founder report
~$190/mo
Founder-reported historical cash expense, excluding labor
Audit provenance: founder-supplied RVC eight-phase read-only VPS/source audit and separate Real Gamers static/source audit. Neither is a third-party certification.
Evidence
What was observed: and what was not.
Do not mistake implementation for production-scale proof.
Inspected designs
Project row locking, realtime authorization, private media delivery, credit reservation and payment webhook verification.
Not demonstrated
Independent pentest, sustained throughput/load profile, universal pass of detected tests, third-party attribution of creator revenue.
Product adoption
Account and export screenshots are dated samples; external activation, repeated use and paid conversion still need instrumentation.
Scope boundaries are inherited from the September audit itself, not inferred from newer live checks.
Architecture
A deployed web, data and worker architecture.
Explicit separation of interactive requests, realtime collaboration and media jobs.
Request layer
nginx/TLS → Gunicorn/Django HTTP application; Daphne/Channels for Studio WebSockets.
State + queues
PostgreSQL for app and transaction state; Redis for Channels and background task transport.
Render pipeline
Celery Studio export queue, FFmpeg/FFprobe render/validation, private media delivery.
Voice / video
video generation worker, separate CPU preprocessing and GPU voice inference/generation queues; recovery scheduler.
Commerce
PayPal live billing integration, subscriptions, credit reservations and ledger records.
Operations
Systemd-managed services and retention timers; shared host with other projects.
Observed on a shared Ubuntu/Plesk VPS in September 2026. Production and “staging” hostname mapped to the same Gunicorn runtime.
Studio
From authorized project to validated export.
Features are meaningful when the state transitions are correct.
Project access
Authenticated workspace/project lookup and project revision checks.
Concurrent edits
Row-lock and expected-revision strategy for HTTP/WebSocket saves; stale revision returns a conflict.
Upload boundaries
Size limits, media type/signature/probe validation, SHA-256 and private delivery.
Render validation
FFmpeg argument arrays without observed shell invocation; stream/container validation post-export.
Source inspection and targeted media-access HTTP checks; not a full cross-browser performance benchmark.
Collaboration
Realtime edits have an authority path.
Access is rechecked when saving, not only at socket connection.
Authenticate
Daphne/Channels connection requires an authenticated user.
Authorize
Project is scoped through the workspace-visible project query.
Serialize
Transaction and database row lock guard state updates.
Version
Expected revision, operation count, payload size and cursor bounds are validated.
Broadcast
Messages are distributed through Redis Channels layer.
Audit cleared a suspected connection-only authorization issue in inspected save paths. No external hostile WebSocket matrix was run.
VoiceLab
Voice processing is a recoverable job lifecycle.
CPU preprocessing, GPU generation and scheduler have distinct roles.
Prepare
Enrollment/reference preprocessing with consent/version checks.
Generate
GPU-backed Chatterbox voice processing and recorded outputs.
Recover
Stale-job detection, requeue logic and bounded attempts.
Deliver
Private output/project asset handling; failure states kept in the job record.
Models/tests and workers were observed in September audit; independent throughput, quality benchmarking and universal job success were not established.
Infrastructure
Dedicated workers reduce coupling: not host risk.
Production services were observed on a shared multi-application VPS.
Public tier
Gunicorn :8010 and Daphne :8011 bound to loopback behind nginx.
Media tier
video generation worker, Studio export worker, voice CPU, voice GPU and recovery scheduler.
Scheduling
Support maintenance and backup/retention timers.
Hardening reality
Worker units had stronger systemd sandboxing than Gunicorn/Daphne; resource limits were not configured.
Services and ports are historical observations from September audit, not an assertion of present configuration.
Security
Security work is visible in the implementation.
Observed controls are encouraging; an audit is not a certificate.
Private files
Actual existing private-media file requests returned HTTP 404 on both production and staging hostnames.
Billing integrity
PayPal signature-verification path, idempotent webhook handling, transactional reservation and refund logic.
Upload boundary
File signature checks, probed media formats, private project asset streams and bounded message/state sizes.
Access control
Project user scope, realtime write re-authorization and owner-controlled paid-generation approvals.
No confirmed critical application-layer vulnerability was identified in inspected paths; complete authentication/pentest coverage was NOT performed.
Testing
What the test inventory tells us
The source contains substantial automated testing. A full passing run was not captured in these audits.
774
RVC detected test functions across major Django app domains
357
Real Gamers detected tests in the separate static audit
RVC topics
Payments, promotions, concurrency, project revision, uploads, voice state recovery and support rate limiting.
Native topics
GPU mailbox, AV timing, H.264 queue behavior, recording recovery, replay and RTMP transport.
Audit boundary
Neither September audit captured execution of every detected test. An executed, timestamped test report is the next diligence artifact.
774 and 357 are independent project inventories; not one combined product’s passing suite. Results have not been re-executed in this package.
Usage
What we know about product use
The current product records do not yet show independent adoption at scale.
11
Django accounts in Oct. 21 admin snapshot (6 staff/internal)
5
Non-staff records, not yet verified external users
0
Confirmed paid subscribers / recognized subscription revenue
25
Export-job screenshot sample; 12 marked Ready
Next instrumentation
Independent registration, first usable export, recurring weekly creators and cohort retention.
Next validation
Completed real checkout, paid customer interviews, net revenue and per-export compute margin.
Snapshots do not establish successful public downloads, activated creators, or revenue. Baseline from Oct. 21 materials.
Real Gamers
Real Gamers, a separate desktop system
Native capture and streaming work is a future option, not an RVC feature today.
Capture + GPU
Rust/Tauri, D3D11/DXGI capture, frame mailbox and compositor.
Audio + encoding
WASAPI, timing/mixing, Media Foundation H.264/AAC.
Distribution
Custom RTMP/RTMPS transport, MKV recording/recovery, replay and remux.
Current gaps
Replay memory pressure, unbounded queues, WebView CSP and local-service hardening were flagged.
September Real Gamers static/source audit; runtime fuzzing, GPU device-loss and stress tests not performed. Do not imply general availability or RVC integration.
Risks
Findings that deserve follow-up
Specific engineering work identified in the September review.
Trust boundary
Shared writable voice-runtime files under the web-tier identity weakened separation.
Resource limits
High-load media services lacked effective systemd memory/CPU quotas.
Service sandbox
Public Gunicorn/Daphne had weaker sandbox settings than voice/export workers.
Staging isolation
Production and staging hostnames shared the same app process and live payment runtime.
RVC-BOUNDARY-001 · RVC-RESOURCE-001 · RVC-SVC-001 · RVC-DEPLOY-001 from Sep. 24 audit. Remediation status requires a fresh re-audit.
Priorities
Technical priorities for the coming year
Current controls should be measured, retested and strengthened as use grows.
Q1 : instrument
Independent user classification, first-export funnel, stable tracking and dated executed test reports.
Q2 : activate
Reduce time-to-export, introduce external reviewer, prioritized sandbox/resource hardening.
Q3 : repeat
Retained creators, compute cost per export, recovery and workload profiling.
Q4 : prove
Subscription conversion, churn, acquisition unit economics and operational continuity runbooks.
Proposed gates align with the 12-month investor budget; outcomes require actual users and dated financial records.
Contact
Review the system and its limits
Architecture, source and dated records can be shared for diligence.
We can review architecture, dated audit reports, redacted test output, a guided product demo and measurement plans. Outside technical review, production load metrics and external customer cohorts remain part of the financing work.
Engineering record based on founder-supplied September 2026 read-only and static audits; October 21, 2026 customer snapshot. No new production audit conducted by this update.