Claire’s post hit home. We’ve faced the same at Atlassian. Sharing some of the key actions we took below. With AI products, abuse isn't just annoying, it's expensive. Every LLM call costs real money and for small businesses this can be absolutely crippling. We got hit with stolen cards, fake trials and credit-burners. This is what helped (none of it is a silver bullet, it's a constant battle): 1. Make free trials cost something. Require a card and pre-auth it up front. Even then, we saw stolen cards and fraudsters paying just to get in the door. 2. Only let your real app talk to your backend. Verify requests actually come from your client, not just that they carry valid credentials. 3. Allow only the models you offer. Block everything else by default. Fraudsters want the latest and greatest. 4. Set hard limits per account and per org, with no overage until payment clears. It feels wrong and counterintuitive to start from "I literally don't trust you", but when needs must. 5. Bill sooner. If you charge in arrears or give a grace period on failed payments, abusers sign up with cards that won't clear, burn credits fast and vanish. 6. Use fraud tooling. Your payment provider's rules, like Stripe Radar, can flag and block suspicious accounts. 7. Watch costs daily and act fast. Suspend bad accounts and be ready to pause sign-ups. At one point we temporarily paused all new sign-ups and only sold to existing customers. 8. Restrict free trials to verified business domains. Block disposable and free email domains, and cap how many trials one domain can start. Biggest lesson: abusers adapt crazy fast. Close one door and they try another. It's a shitty game of whac-a-mole, so plan for ongoing defence, not one-off fixes.

Vulnerable post: I spend 90% of my time on @chatprd dealing with increasingly creative international token fraud operations, and it makes me want to shut down the company. Mostly to steal Opus tokens on resold promo codes or in the time between a trial start + our fraud alerts infra. It's cost me tens of thousands of dollars and it gets worse every day. Luckily the company is nice and profitable, but every time it happens it bums me out in extreme ways. I love ChatPRD, I think at this point we've helped PM, engineers, and founders with millions of products + features. We are still a top 3 writing GPT (completely free!) on ChatGPT, we've kept generous trial periods, and have kept annual sub costs super reasonable, even for the enterprise. We've let people use the latest models when they come out, and have built in new features like prototyping without adding to our fees. We haven't had to limit usage, because our customers have been so great. Building the product is incredibly fun, it's an actual footprint by which I get to test all this AI stuff, as an engineer, founder, and product builder. I have my little grok bot army that runs ops. We've been pen tested multiple times, SOC2ed, and work with some of the biggest companies out there. It's my labor of love, and I keep it going (even though there are probably higher leverage things I could be doing with my time.) But it's horrible to have our small team spend basically all of our time shutting down that Indonesian fraud ring, or that Egyptian code farm, or the Chinese signups that have been on an auto loop for the last 24 hours. I feel like I'm constantly making product calls that trade protecting from abuse vs giving our users an amazing experience (and keeping maintenance overhead low.) It's basically sucked the joy out of my first little AI win, and I'm really sad about it. And before you bucket me into dumb-little-vibecoder, trust that I know what I'm doing. I run our firewall like it's my full time job. We are stripe radar'd up to the gills. We have rate limits + so many automated triggers and controls. But each one of these things ends up touching legitimate users and prospects. And every time I rachet up one control, I end up causing annoyance or pain to a real user. It's a trade that's hard to manage. And honestly? It's not fun. It just feels bad to see so many bad people. So I have some thinking to do, but for now - free trials are dead on chatprd, sorry kids - i think in 2027 i might ban all non-US business - and tbh, may retreat to the warm waters of 100% enterprise business, who are a) willing to pay more and b) have more interesting product needs And if you're a little solo founder or startup that has dealt with this - I see you. I have some tips + tricks that might help. You're not dumb, and it's not easy. Ok. Rant over. Back to building the little wrapper who could 💕

Built a physical simulation of a record player with WebGL2 and Web Audio. It's *shockingly* accurate: Instead of playing a song, it works by converting it into the physical shape of a groove. Then a simulated stylus rides those walls 384,000 times a second, and you hear the voltage that motion would induce in a cartridge. So the crackle, the pops, the wow/flutter, the dull inner grooves are natural byproducts of the simulation. You can also "DJ" the record. (The converted songs are in the public domain or CC-licensed. Code is linked for you to remix and re-deploy.)