Vibe AI - AI Chat and play

Hey everyone! I’m a full-stack dev from Italy. I built a project solo that started as one thing and became another, and I wanted to share it here — mostly for the technical side, but I’ll explain the whole thing. It’s called vibeAI, and it’s two halves that fit together. ━━ THE CHAT SIDE ━━ - Create your own AI characters: personality, backstory, avatar, tone of voice - Chat one-on-one, or put several of them in a group chat and let them interact - Discover and chat with characters made by other users - Free daily messages for everyone ━━ THE GAME SIDE (Vibe Battle) ━━ There’s a full fighting game inside the app, and the enemies include the AI characters you created yourself. - Timing-based combat, not button mashing: stop a moving bar in the green zone to hit, tap a shrinking circle to parry — watch out for feints - Campaign of 60+ opponents: 50 presets plus your own characters, shuffled with a seed so every run is ordered differently - A boss “cameo” that ambushes you mid-run — unbeatable by design, it wrecks you and leaves - A 3-phase final boss that scales to your build - Skins with permanent HP/damage bonuses, premium moves limited to one use per match - Live 1v1 PvP, matched by XP - Global leaderboard ━━ THE TECHNICAL PART (the reason I’m posting) ━━ The thing that took longer than everything else combined was the multiplayer anti-cheat. The first version was client-authoritative — each client computed its own damage and reported it. Took me five minutes to realize you could just open the console and claim “I did 9999 damage.” Useless. So I moved all authority to the server: - Match state (HP, turns, rounds) lives on the server, not the clients - Clients NEVER declare damage — they only report how accurate their timing was (perfect / good / miss) - The server rolls the damage by reading real stats from the database - End-of-match rewards go through signed, single-use sessions with daily caps, so tampering with the browser client gains nothing - Real-time sync runs on Supabase Realtime broadcast, with a REST fallback for when the websocket doesn’t deliver Stack: React + TypeScript, Supabase (auth, Postgres, Realtime), Stripe, Vercel. It’s a PWA — no app store, installs to the home screen on Android and iOS. ━━ ON MONETIZATION, to be upfront ━━ Free to play, no content locked behind payment — campaign, final boss and PvP are all accessible. Optional purchases (cosmetic skins, in-game currency) exist to cover API and infra costs. Saying it upfront rather than hiding it. ━━ ━━ ━━ Heads up: the UI is in Italian — it was built for the Italian Gen Z crowd, and the preset characters are local archetypes. But the combat is bars, circles and timing, so it plays fine in any language, and the characters that matter are the ones you create yourself. If anyone here has worked on real-time multiplayer or Supabase Realtime, I’d love to compare notes — there are a couple of choices (abandoned-match handling, the broadcast fallback) I’m not sure I got right.