Building in public, part 2: how to find the thing an auto-completer can't copy
Originally published on Chirpper.
Anyone with an AI coding tool can rebuild your product over a weekend. That's not a fear anymore, it's just true. So the question every builder has to answer now isn't "can I build it?" It's "what still protects me after someone copies it?"
This piece gives you a way to answer that for your own project. I'll use the day I asked the same question about my own social site as the worked example, including the part where I got it wrong.
The day I asked the question
On March 5, 2026, I started designing a social site with ChatGPT. The idea: no logins, and posting only by invite. Every invite links back to whoever sent it, so your reputation travels with the chain of people who brought you in.
A few prompts in, I stopped and asked the scary question:
"What's the moat? If it's simple to build are we already dead - I don't think so - cause this is more like a first mover advantage play where no one could copy it once a network effect is created."
In the same message I named it. I already owned chirpper.com, so that was that.
The answer I got back is the framework below, plus what almost eight months of actually running the thing taught me about it.
What stopped being a moat
Start by crossing these off. They used to buy you time. With AI writing most of the code, they don't anymore.
Your code. If it can be described, it can be rebuilt. A tight spec is basically a copy button.
Your features. A feature list is a prompt someone else hasn't typed yet.
Your UI. Screenshots are enough to clone a design.
Shipping first. Being first only helps if being first leaves something behind that a later arrival can't get.
That last one is the key. First-mover advantage isn't a moat by itself. It's a head start on building one.
Six moats that still work
Every one of these shares a trait: it builds up over time from real use. A clone that launches next year can copy the product on day one, but it starts this list at zero.
1. A graph that gets better with every user
This was ChatGPT's answer for Chirpper, and it's the strongest one. The value isn't the code, it's the record of who invited who and which chains of people produce good stuff. A copycat gets the software and none of the history. For users to switch, they'd have to walk away from everything they built up.
Test: Does your product get more useful for user #500 because users #1 through #499 showed up?
2. Connections to the systems your users depend on
Anyone can build a personal finance or bookkeeping app in an afternoon now. The screens are the easy part. The hard part is getting the transaction data out of thousands of banks, reliably and cheaply.
Intuit has spent decades on that. It signed direct data-sharing agreements with Chase and Wells Fargo back in 2017, so its apps pull bank data through APIs instead of scraping logins. That plumbing is a big part of why people keep paying for QuickBooks Online, which runs $38 to $85 a month on its two cheaper plans and up to $340 at the top.
A new app has to rent that access, usually through an aggregator like Plaid. And renting is getting pricier: in September 2025, Plaid agreed to start paying JPMorgan Chase for customer data it used to get for free. Banks now charge the middlemen, and the middlemen charge you.
Test: What outside systems does your product connect to that would take a competitor years, or a lot of money, to connect to?
3. Data you only get by operating
Not data you scraped or bought, which anyone can get. Data that only exists because people use your thing: their history, their corrections, what worked and what didn't.
Test: If a competitor copied your app today, what would be missing from their database that's in yours?
4. An audience you own
If your users find you through a platform's algorithm, the platform owns your distribution and can turn it off. An email list, a community, or a site of your own is reach a clone can't copy. That's why I publish on my own site first and treat other platforms as places to repost.
Bloggers used to know this. You owned your blog, your readers came to you, and nobody could throttle your reach. I think the modern version goes one step further: with AI, you can now build your own small social network the way people used to start a blog. I'll make that case in its own piece soon, because it deserves more than a paragraph.
Test: If every social platform banned you tomorrow, how many people could you still reach?
5. Trust and a real person behind it
AI can generate unlimited content and unlimited fake users. What it can't generate is first-hand experience or a verified human. Your track record, your name on the work, and proof that real people are behind it are getting more valuable, not less.
Test: Would a reader or customer care if they found out it was you versus an anonymous clone?
6. Switching costs people actually feel
Not fake lock-in, like making export hard. Real cost: the setup, the history, the habits, the reputation someone would have to rebuild somewhere else.
Test: What does a user lose, concretely, if they leave you for a copy?
Look at the list again and you'll see a common thread: connections. Connections between your users. Connections to the banks, carriers, or tools your users rely on. Connections to an audience. Connections to people who trust you. Code is a thing you can copy. A connection is a relationship, and relationships take time.
Notice what's not on the list: speed, design, and being clever. Those help you win a race, but they don't protect a lead.
The catch: a moat around an empty castle
Here's what I wish I'd underlined that morning. ChatGPT said it in one line: the biggest risk isn't being copied, it's that the network never starts. Nobody clones a ghost town.
Then we spent most of the session defending against problems that only show up with a crowd. Spam chains. Invite cartels gaming reputation. Whether replies should cost an invite so conversations stay high quality. ChatGPT treated that replies question as the decision that would make or break the network.
I left replies wide open, with no login of any kind, for a long time. It didn't matter at all. Nobody was trying to reply. The noise never came, and neither did the commenters.
Most of the moats above only start working once people show up. So the order matters:
Get people in the door and give them a reason to stay.
Make sure every one of them adds something a clone can't copy.
Worry about defending it once there's something worth attacking.
The best moat is one that starts filling on day one. Every invite on Chirpper adds to the graph from the very first user. That's the property to look for: a moat that grows as a side effect of normal use, not one you have to build later.
Find your moat in 15 minutes
Grab a notepad and answer these about your own project. Be honest, because nobody else is going to see it.
The clone test. Imagine a competitor ships an exact copy of your product next month. Write down everything they'd still be missing. If the list is empty, you don't have a moat yet.
The user #500 test. Does each new user make the product better for everyone else? If yes, that's your graph. Make it visible and make it grow.
The plumbing test. List every outside system your product plugs into: banks, carriers, marketplaces, other people's software. Which of those connections would a new competitor have to beg, pay, or wait years for? Those are worth deepening.
The database test. What do you collect that only exists because people use you? Start saving it now, even if you don't use it yet.
The ban test. How many people can you reach without any platform's permission? If the answer is close to zero, start an email list or a home base this week.
The name test. Would people care that it's you? If not, start putting your name and your real experience on the work.
The day-one test. Which of your answers start working with your first user, and which need a crowd? Build the day-one ones first.
Pick the one or two with the strongest answers. That's your moat. Spend your time making them deeper, and stop polishing the features a clone will copy anyway.
Top comments (0)