Anyone with an AI coding tool can rebuild your product over a weekend. That's not a fear anymore, it's just true. So the question every builder has to answer now isn't "can I build it?" It's "what still protects me after someone copies it?"

This piece gives you a way to answer that for your own project. I'll use the day I asked the same question about my own social site as the worked example, including the part where I got it wrong.

The day I asked the question

On March 5, 2026, I started designing a social site with ChatGPT. The idea: no logins, and posting only by invite. Every invite links back to whoever sent it, so your reputation travels with the chain of people who brought you in.

A few prompts in, I stopped and asked the scary question:

"What's the moat? If it's simple to build are we already dead - I don't think so - cause this is more like a first mover advantage play where no one could copy it once a network effect is created."

In the same message I named it. I already owned chirpper.com, so that was that.

The answer I got back is the framework below, plus what almost eight months of actually running the thing taught me about it.

What stopped being a moat

Start by crossing these off. They used to buy you time. With AI writing most of the code, they don't anymore.

• Your code. If it can be described, it can be rebuilt. A tight spec is basically a copy button.
• Your features. A feature list is a prompt someone else hasn't typed yet.
• Your UI. Screenshots are enough to clone a design.
• Shipping first. Being first only helps if being first leaves something behind that a later arrival can't get.

That last one is the key. First-mover advantage isn't a moat by itself. It's a head start on building one.

Six moats that still work

Every one of these shares a trait: it builds up over time from real use. A clone that launches next year can copy the product on day one, but it starts this list at zero.

1. A graph that gets better with every user

This was ChatGPT's answer for Chirpper, and it's the strongest one. The value isn't the code, it's the record of who invited who and which chains of people produce good stuff. A copycat gets the software and none of the history. For users to switch, they'd have to walk away from everything they built up.

Test: Does your product get more useful for user #500 because users #1 through #499 showed up?

2. Connections to the systems your users depend on

Anyone can build a personal finance or bookkeeping app in an afternoon now. The screens are the easy part. The hard part is getting the transaction data out of thousands of banks, reliably and cheaply.

Intuit has spent decades on that. It signed direct data-sharing agreements with Chase and Wells Fargo back in 2017, so its apps pull bank data through APIs instead of scraping logins. That plumbing is a big part of why people keep paying for QuickBooks Online, which runs $38 to $85 a month on its two cheaper plans and up to $340 at the top.

A new app has to rent that access, usually through an aggregator like Plaid. And renting is getting pricier: in September 2025, Plaid agreed to start paying JPMorgan Chase for customer data it used to get for free. Banks now charge the middlemen, and the middlemen charge you.

Test: What outside systems does your product connect to that would take a competitor years, or a lot of money, to connect to?

3. Data you only get by operating

Not data you scraped or bought, which anyone can get. Data that only exists because people use your thing: their history, their corrections, what worked and what didn't.

Test: If a competitor copied your app today, what would be missing from their database that's in yours?

4. An audience you own

If your users find you through a platform's algorithm, the platform owns your distribution and can turn it off. An email list, a community, or a site of your own is reach a clone can't copy. That's why I publish on my own site first and treat other platforms as places to repost.

Bloggers used to know this. You owned your blog, your readers came to you, and nobody could throttle your reach. I think the modern version goes one step further: with AI, you can now build your own small social network the way people used to start a blog. I'll make that case in its own piece soon, because it deserves more than a paragraph.

Test: If every social platform banned you tomorrow, how many people could you still reach?

5. Trust and a real person behind it

AI can generate unlimited content and unlimited fake users. What it can't generate is first-hand experience or a verified human. Your track record, your name on the work, and proof that real people are behind it are getting more valuable, not less.

Test: Would a reader or customer care if they found out it was you versus an anonymous clone?

6. Switching costs people actually feel

Not fake lock-in, like making export hard. Real cost: the setup, the history, the habits, the reputation someone would have to rebuild somewhere else.

Test: What does a user lose, concretely, if they leave you for a copy?

Look at the list again and you'll see a common thread: connections. Connections between your users. Connections to the banks, carriers, or tools your users rely on. Connections to an audience. Connections to people who trust you. Code is a thing you can copy. A connection is a relationship, and relationships take time.

Notice what's not on the list: speed, design, and being clever. Those help you win a race, but they don't protect a lead.

The catch: a moat around an empty castle

Here's what I wish I'd underlined that morning. ChatGPT said it in one line: the biggest risk isn't being copied, it's that the network never starts. Nobody clones a ghost town.

Then we spent most of the session defending against problems that only show up with a crowd. Spam chains. Invite cartels gaming reputation. Whether replies should cost an invite so conversations stay high quality. ChatGPT treated that replies question as the decision that would make or break the network.

I left replies wide open, with no login of any kind, for a long time. It didn't matter at all. Nobody was trying to reply. The noise never came, and neither did the commenters.

Most of the moats above only start working once people show up. So the order matters:

1. Get people in the door and give them a reason to stay.
2. Make sure every one of them adds something a clone can't copy.
3. Worry about defending it once there's something worth attacking.

The best moat is one that starts filling on day one. Every invite on Chirpper adds to the graph from the very first user. That's the property to look for: a moat that grows as a side effect of normal use, not one you have to build later.

Find your moat in 15 minutes

Grab a notepad and answer these about your own project. Be honest, because nobody else is going to see it.

1. The clone test. Imagine a competitor ships an exact copy of your product next month. Write down everything they'd still be missing. If the list is empty, you don't have a moat yet.
2. The user #500 test. Does each new user make the product better for everyone else? If yes, that's your graph. Make it visible and make it grow.
3. The plumbing test. List every outside system your product plugs into: banks, carriers, marketplaces, other people's software. Which of those connections would a new competitor have to beg, pay, or wait years for? Those are worth deepening.
4. The database test. What do you collect that only exists because people use you? Start saving it now, even if you don't use it yet.
5. The ban test. How many people can you reach without any platform's permission? If the answer is close to zero, start an email list or a home base this week.
6. The name test. Would people care that it's you? If not, start putting your name and your real experience on the work.
7. The day-one test. Which of your answers start working with your first user, and which need a crowd? Build the day-one ones first.

Pick the one or two with the strongest answers. That's your moat. Spend your time making them deeper, and stop polishing the features a clone will copy anyway.

Sources

• Chase and Intuit data-sharing agreement (Jan 2017)
• Wells Fargo and Intuit data exchange agreement (2017)
• Plaid agrees to pay JPMorgan for data access (Sept 2025)
• QuickBooks Online pricing, updated Oct 2026

Brainstorm an idea with me. I would like a social media site that does NOT require a login or sign up. What are some ways we could make something like that work - and by "work" I mean - work for being a great social media site, not just how do we allow anonymous posting.

That prompt is what led to what is now a 9 month project - so far. 

Why no login?

Reddit. I used it a lot, and every year it got harder for someone who just wanted to post without handing over an identity. Subreddits that won't let a new account post for weeks. Sign-up walls in front of threads you only wanted to read. An email address that's required instead of optional. Admins who ban first and ask never. And my personal pet peeve, the non-stop wall trying to force you to download their stupid mobile app.

I wasn't trying to start a company. I wanted to see if there was a better way.

The problem the first answer named

The ChatGPT reply came back with ten wildly different ideas: identities generated silently in your browser, posts that expire after a day, a new pseudonym every morning, AI moderation that quietly limits bad posts instead of deleting them.

The useful part was at the end. Every anonymous platform eventually dies from the same four things: spam, trolls, bots, and low-effort content. So the real problem isn't anonymity. It's being anonymous - something reddit is getting closer and closer to killing off - but still reputation-aware.

That sentence turned out to be the whole project.

The second prompt

My reply:

Invite only was a great model for how facebook went from being walled off to a public platform, without signups it doesn't seem possible, but I'd like to explore if we could make it possible. They could be expiring token links maybe, where an invite allows you to create a post, but once that invite is used it's dead and you can't create a post with it???

As AI will do, it stroked my ego and told me what a great idea it was. As a rule I'm skeptical of anything AI says, but I played along until a bigger idea raised my eyebrows: an invite tree lets you share trust between users and also share distrust. That builds in an incentive to invite only people you trust, or at least not to invite idiots.

In what turned out to be a long detour, it also suggested that every post could generate three "seed" links. That one word is why the next ten days went into building a plant metaphor to communicate the idea.

The third prompt

The word "token" kept nagging at me. A chain of tokens, each pointing back to the one before it, sounded a lot like a blockchain. So I wrote back:

Yes!!! and what if these earned invites are like a blockchain? Where we can trace back to the original invite to tally up an ongoing score for the original chain initiator. Every invite is a new chain (new person).

Not invited by "David" but invited by a83jf and you can chain link back to see some kind of reputation.

A score/reputation attached to who ever has the abc.com/a83jf/<token> link, and that score is attached to new posts made with that link so that they have a meritocracy of who can show up at the top of the homepage feed.

That's when it clicked: the idea stopped being about anonymity and started being about anonymous accountability. You don't need to know someone's name if you can see the chain of people who vouched for them, and a score that travels with every post. Ten days later that chain got its name: the TrustChain®.

What existed 24 hours later

By March 6, the first database schema was written. It had no users table at all. It had an invites table where every invite records its parent and its root, and a posts table where every post requires an invite. Use an invite to post and it's consumed. You can't post with it again.

When a post went up, it minted fresh invites for the poster to hand out. Three of them in the first production test. Every post grew new branches.

No accounts. A token in your browser, a device cookie to stop double voting, and AI scoring comments in the background. It was running end to end on the live domain by March 7, two days after the first prompt.

What's with the plants?

A lineage that branches looks like a tree, so for the first ten days everything was botanical, and I put a lot of effort into making this seed / plant / bird metaphor work. An invite was a seed. Posting planted it. Comments were chirps. Threads were branches and the whole token lineage was a tree.

Kill your darlings

In my head the plant metaphor felt creative and special. I spent 8 days massaging it until on March 15 I renamed all of it in a single migration: seeds became invites, plants became posts, branches got eliminated, and the tree became the TrustChain.

The reason was simple. A new visitor was being asked to learn a whole new vocabulary on a website they had never heard of. That's two unfamiliar things at once, and it was too much. One table called plant_media survived in the database for months afterward, the last fossil of the garden.

What I'd tell someone starting today

1. The question you start with isn't the product. I asked for no login. What I got was a system where who let you in becomes your identity.
2. Decide whether being creative and different serves the idea or takes away from it. Clever vocabulary is a tax on every new visitor, and new visitors are the ones you can least afford to tax.
3. Ship on day two. The first version was in production 48 hours after the first prompt. Everything I learned after that came from it being real.

Upcoming topics

• The architecture I used.
• The login comes back.
• Hiring my first help.
• Opening it up for critique.
• My first wins with podcasts.
• I know the odds. I’m having fun anyway.
• Your own social network is the new blog.

If anything piques your interest, tell me in the comments.