Name Squatted Before You Ship? Locking Down Brand Assets Before Your Vibe Project Launches

A note on scope, so you read the right guide. This site has a companion guide, What To Do When You're Copied: IP Enforcement for Vibe Projects (slug: vibe-project-ip-defense-guide), which covers reactive enforcement — how to preserve evidence, send takedown notices, and pursue platform removals and legal action after someone copies your product or squats your trademark. This guide covers proactive defense: a checklist to lock down your name, domains, trademarks, developer accounts, and social handles in the two weeks before launch, so squatters and impersonators never get an opening. Read this one first, close the gaps, then launch; if something still goes wrong, reach for the enforcement guide.

Indie developers almost never lose on branding because "the product was bad." They lose because "the name was great — but never locked down." The three cases below all really happened, and each cost real money.

1. Three Real Rename and Squatting Cases — All Paid in Cash

Case 1: GPT Engineer → Lovable, a forced rename after going viral

In 2024, Anton Osika's open-source project GPT Engineer ("generate an entire codebase from one sentence") exploded on GitHub and became one of the defining projects of the vibe coding wave. But commercialization exposed two fatal problems with the name: first, "GPT" in the name carried serious trademark risk (OpenAI has always been sensitive about the GPT mark); second, the name was so generic that searches returned tutorials and copycats, leaving zero ownable brand equity. In September 2024, the project rebranded to Lovable and moved to lovable.dev.

The cost was concrete: all documentation rewritten, SEO equity reset to zero, early users forced to rebuild their mental model, and every third-party tutorial suddenly referencing a dead name. Lovable went on to raise hundreds of millions at a multi-billion valuation, so it could absorb the hit. But if you're an indie developer forced to rename with a few hundred users, you lose your most precious asset — early word of mouth. All of it avoidable with a 30-minute name search before you commit.

Case 2: Tempo → Create, the domain reality of an AI website builder

AI website builder Tempo Labs rebranded to Create in 2024, moving to create.xyz. Nothing was wrong with "Tempo" per se — the problem was ownability: dozens of companies and products are called Tempo (music, fitness, SaaS everywhere), so users searching "Tempo AI" could never find it. After the rename, the brand had instant distinctiveness — but the price was a full rebuild of brand assets: 301 redirects from the old domain, an unchangeable name on the historic Product Hunt page, and all early press pointing at a dead brand.

The lesson: whether a name sounds nice is secondary; whether you can own it is primary. A "great name" shared with ten industries is a bad name for an indie developer.

Case 3: Nissan.com, the textbook domain-squatting saga

In 1994, Uzi Nissan — a computer shop owner in North Carolina whose actual surname is Nissan — registered nissan.com to sell computers. Nissan Motor sued him in 1999, and the fight dragged on for over two decades. Courts ultimately ruled that Uzi Nissan had a legitimate right to do business under his own surname, but couldn't run car ads on the site. Both sides compromised; nissan.com remains the small computer company's site to this day, and the automaker uses nissanusa.com.

Two takeaways for indie developers: first, first-come-first-served is iron law — surnames and common words included; whoever holds the domain holds the leverage. Second, don't count on "being right" to win in court — if an auto giant couldn't pry a domain from a tiny computer shop, an indie developer definitely can't afford the time and legal fees of UDRP arbitration or litigation. A domain costs a dozen dollars a year to defend and thousands in arbitration fees to attack. You only need to do that math once.

There's also a closer threat: trademark-based app store takedowns. Both Apple and Google accept complaints from trademark owners — if someone can show a registered trademark on your app's name, the store can pull your app without any lawsuit first. Your code wasn't copied at all; you just collided with a trademark, and you're back to zero overnight. This kind of "lawful harm" happens daily, and the defense is the search checklist in the next section.

2. The Four-Step Name Search Checklist (Run Before You Commit)

Once you like a name, don't trust the feeling that "probably nobody uses it." Run these four steps — every tool is free, and the whole pass takes under an hour.

Step 1: Trademark database search (most important, most skipped)

• China: the CNIPA Trademark Office search portal (sbj.cnipa.gov.cn), free. Run a comprehensive search on your name and look for identical and similar marks. "Similar" isn't just identical: same pronunciation with different characters, lookalikes, and similar meanings can all be cited against you.
• US: the USPTO Trademark Search (formerly TESS), free, with fuzzy matching.
• EU / international: EUIPO eSearch plus; for global ambitions, the WIPO Global Brand Database covers multiple countries at once.

The bar: if an identical or similar mark exists in the same class (more on Nice classes below), drop the name immediately — don't gamble on "I'll use it first." Trademark systems are first-to-file; using it earlier without registering means you're exposed.

Step 2: Domain availability check

• Check yourname.com on Cloudflare Registrar or Namecheap, plus .ai, .io, and .dev.
• If the .com is taken, check WHOIS: a parked page usually means it's buyable (just ask for a price); an active site means it's essentially hopeless — change the name.
• Use a tool like instantdomainsearch.com to batch-test variants and map how crowded the namespace is in 10 minutes.
• Iron rule: if you can't get or afford the .com, kill the name. Don't console yourself with ".io looks cool too" — when you grow, the .com holder will name a price you can't pay, or worse, users will mistype their way onto someone else's site.

Step 3: Developer-ecosystem availability

Vibe projects usually ship an open-source repo, an npm package, or a CLI — and those names are brutally expensive to change once taken:

• Search the name on npmjs.com, pypi.org, and crates.io; search GitHub for matching orgs and repos;
• Check Docker Hub and Homebrew formula names while you're at it;
• Note: an npm package name can never be deleted and reused once published (you can only deprecate it). If it's taken, you're stuck with a prefix like @yourname/xxx, and brand consistency takes an instant haircut.

Step 4: App store and social handle check

• Search the App Store and Google Play for same-name apps — name collisions mean users download the wrong app and leave reviews on the wrong page;
• Search X (Twitter), Instagram, TikTok, YouTube, and Bilibili for matching accounts;
• Search Product Hunt's history — if a same-name product already won awards there, your SEO will forever rank second.
• Lazy option: namecheckr.com checks dozens of platforms' username availability in one shot, results in 5 minutes.

Only when all four steps are green is the name "usable." Any red flag means going back to rename, not patching — with naming, replacing the name is always cheaper than defending it.

3. Domain Strategy: .com or .ai? How Many Defensive Registrations?

Choosing a TLD: a decision table

• Consumer-facing, global, lots of word-of-mouth → default to .com. .com is still user muscle memory — "what's your site?" "xxx dot com" — typed correctly on the first try. Email deliverability is also most stable on .com.
• AI tooling, developer audience → .ai or .io is acceptable, but still hold the .com. .ai renewals run $70–140/year, 5–10× a .com, and .ai registry policy is comparatively less stable. Strategy: market on .ai, but also buy the .com and redirect it, so traffic can't be intercepted.
• Watch out for .dev: Google added the entire .dev TLD to the HSTS preload list — HTTPS is mandatory, and browsers flatly refuse plain-HTTP access. If your early vibe demo has no cert yet, don't trap yourself with .dev.
• China-first audience → hold .com + .cn together. .cn requires real-name verification, adding ~3 days of process — start early.

Defensive registrations: how many is "enough," how many is "waste"

Variants worth locking, in priority order:

1. The core .com (mandatory, renew for 5–10 years);
2. 1–2 common misspellings (any easily confused letters in your name);
3. Singular/plural variants (if getxxx/tryxxx prefixes are taken, at least make sure searching prefix+yourname finds you first);
4. .net and .org each (anti-phishing);
5. .ai or .io, pick one (depends on your audience).

Stop there — no more than 8 total. I've seen indie developers register 40+ variants and burn thousands a year on renewals, 90% of which no human will ever mistype. Defensive registration guards against high-frequency typos and phishing, not every permutation.

Three renewal and security iron rules

• Auto-renew must be on, with a calendar reminder for card expiry. Expired domains get ~30 days of redemption grace (redemption fees run $80–200); after 60–75 days the domain drops back to the public pool, where sniping scripts grab it within 24 hours. More indie developers lose domains to "expired card, missed renewal" each year than you'd think.
• Turn on free WHOIS privacy. Cloudflare and Namecheap include it. Without it, your name, email, and phone sit on public WHOIS, and precision phishing and spam calls arrive on schedule.
• Pick a registrar that's easy to transfer out of, not one with "$1 first year." Ultra-cheap first-year registrars often charge 3× on renewal plus "transfer unlock fees." Cloudflare Registrar renews at cost with no markup — the low-stress choice for indies. Domains can't transfer for the first 60 days, so picking the wrong registrar locks you in for at least two months.

4. Trademark Registration in Practice: China + US Process, Fees, and Rejection Traps

Domains are first-come-first-served; trademarks are first-to-file — you need both locked. Domains stop others from building on your name; trademarks stop others from selling under your name (and suing you for infringement). The good news: official fees on both sides are cheaper than you'd expect. What's expensive is filing blind.

China trademarks: ¥270 per class — a solo founder locks 2 classes first

• Official fee: ¥270/class for e-filing (up to 10 goods/services per class), ¥300/class on paper. Agencies charge ¥500–1,000 in service fees — the process isn't complicated, so e-file it yourself and the savings cover 5 years of domain renewals.
• Picking Nice classes (must-read for software/SaaS): Class 9 (downloadable computer software, apps) and Class 42 (SaaS, software-as-a-service, tech development). These two are the core — lock them first. Add Class 41 for content/education, Class 35 for advertising services. A solo founder starting with Classes 9+42 pays ¥540 in official fees and covers 95% of the risk surface.
• Timeline: filing → formal examination (~1 month) → substantive examination (~4–6 months) → 3-month publication for opposition → certificate. Total: 7–12 months. So file before launch — applying when you already need to enforce is too late. The filing receipt itself deters: in domain disputes and platform complaints, "trademark applied for" and "nothing at all" get two very different treatments.
• The big three rejection grounds and how to dodge them: ① cited prior similar marks — dodged by doing Step 1's search properly, don't skip it; ② lack of distinctiveness — names that directly describe the function (e.g., "AI Code Writer") get rejected; coined words > suggestive words > descriptive words — invented words like Lovable or Vercel are born registrable; ③ adverse social impact — don't ride on celebrity names, place names, or country names.

US trademarks: TEAS filing, post-2025 fee schedule

• Official fees (after the January 2025 increase): TEAS Plus $250/class, TEAS Standard $350/class. Plus is cheaper but stricter (you must pick from USPTO's preset goods descriptions) — usually fine for indie developers.
• Two filing bases: use in commerce (already used in the US — product screenshots and sales records suffice) or intent-to-use (plan to use; requires a later statement of use with extra fees). Pre-launch vibe projects typically file intent-to-use to stake the claim early.
• Timeline: 8–14 months. An Office Action from the examiner is normal — you have 6 months to respond, and the common ones (disclaimer of part of the mark, citation of a similar mark) are usually survivable with amendments.
• Money-saving tip: register only the 1–2 core classes (009 for software, 042 for SaaS in the US system). Don't file 10 classes like a big corp — every class is a real $250.

Going global? The Madrid System covers many countries in one filing

Through the WIPO Madrid System, you can designate the US, EU, Japan, and others in a single application based on your Chinese filing — 50%+ cheaper than hiring agents country by country. One caveat: the "central attack" rule — if your base application dies within 5 years, the international registration dies with it. So the base (Chinese) filing has to be solid.

5. The Day Before Launch: Lock These 12 Account Slots

Trademarks and domains are legal assets; these are attention assets — squatters holding them isn't illegal, but it'll annoy you for three years. Lock them all the day before launch, in about 2 hours, all free:

1. GitHub Organization: create an empty org under your product name;
2. npm / PyPI / crates.io package names: publish a 0.1.0 placeholder (an npm name can never be freed for reuse once published — deprecation doesn't release it);
3. X (Twitter) handle: the exact @ matching your brand; a "launching soon" bio is fine;
4. Domain email: hello@ and support@ on your domain, forwarded free via Cloudflare Email Routing — after launch, all official communication comes from brand email, the cheapest possible proof of "official identity";
5. Product Hunt maker page: register early; the ship page can sit as a placeholder;
6. Instagram / TikTok / YouTube, same name: create each, post one placeholder;
7. Discord server: same name, ready for users to join with one click;
8. WeChat Official Account + Mini Program name (for the China market): the account name only gains protection after verification — start the process early;
9. App Store developer account: app names get a reservation window after creation — claim early; an iOS Bundle ID can never change after going live, so name it deliberately;
10. Google Play package name (applicationId): unchangeable for life — the hardest rule in the Android ecosystem. No version numbers, no placeholder brand words in the package name;
11. Reddit community: create r/yourbrandname;
12. Indie Hackers / V2EX IDs: launch-post author matching the brand reads completely differently in credibility.

With all 12 locked, impersonating you becomes too expensive to bother. That's the essence of proactive defense: don't aim to catch bad actors — aim to make it not worth their while.

6. If You Do Get Squatted or Impersonated (Bridge to the Enforcement Guide)

Even the tightest lockdown can leak. If it happens, escalate through these three tiers — the full evidence-preservation techniques, complaint letter templates, and platform appeal flows live in the companion guide IP Enforcement for Vibe Projects (vibe-project-ip-defense-guide); here is the decision framework:

• Tier 1: domain squatted → UDRP arbitration. File with WIPO or NAF. Three winning elements: the domain is identical or confusingly similar to your mark, the holder has no legitimate interest, and it was registered and used in bad faith. Fees start around $1,500 for a single-member panel, 2–3 months, and a win transfers the domain to you. Note: .cn domains don't use UDRP — they go through CNNIC's dispute rules (CNDRP) via CIETAC or the Hong Kong International Arbitration Centre.
• Tier 2: platform/store impersonation → trademark takedown complaints. GitHub has a dedicated trademark complaint channel; npm, the App Store, Google Play, and X all have impersonation/trademark reporting. You need exactly three things: the trademark certificate (or filing receipt), proof you're the rights holder, and the infringing links. Platforms typically act in 1–2 weeks.
• Tier 3: they're actually selling and profiting → demand letter + litigation prep. This is beyond one-person DIY — get an IP lawyer. Preserve evidence first: historical WHOIS records, notarized (or trusted-timestamped) captures of the infringing site/app, your trademark certificate, and your earliest-use evidence (GitHub commit timestamps and Product Hunt launch dates are natural timestamps).

Order matters: preserve evidence before contacting them. Lead with a lawyer's warning letter and they can wipe the infringing pages in 10 minutes — destroying your evidence along with them.

7. The Solo Founder's Minimum-Viable Plan: Budget + Two-Week Timeline

Budget (CNY)

• China trademark, Classes 9+42, e-filed: ¥540;
• Core .com domain, 5 years: ~¥400–600 (Cloudflare at cost);
• 5–7 defensive variants, first year: ~¥300–500;
• WHOIS privacy: ¥0; the 12 account slots: ¥0;
• Total: ¥1,200–1,700, one-time spend, 5 years of cover.

Targeting the US market? Add one USPTO TEAS Plus filing, 1 class, $250 (~¥1,800). Global total stays under ¥3,500 — less than a rounding error on one forced rename.

Two-week pre-launch timeline

• D-14: run the full four-step name search; finalize the name;
• D-12: register the core domain + defensive variants; enable auto-renew + WHOIS privacy; e-file the China trademark (Classes 9+42);
• D-10: lock the 12 account slots; set up domain email forwarding;
• D-7: DNS configured (A/CNAME, MX, TXT verification), SSL ready; if targeting the US, file the USPTO intent-to-use application;
• D-3: full-list review: search your brand name in an incognito window and confirm every result is you;
• D-1: print the appendix checklist, tick every box, launch.

Appendix: One-Page Checklist (Print and Execute)

• ☐ Trademark search: CNIPA / USPTO / EUIPO, all green
• ☐ .com registrable or held; .ai/.io/.dev as needed
• ☐ No collisions on npm / PyPI / GitHub / Docker Hub
• ☐ No same-name product on App Store / Google Play / X / Product Hunt
• ☐ Core domain registered 5+ years, auto-renew on, WHOIS privacy on
• ☐ ≤8 defensive variants: typos, singular/plural, .net/.org
• ☐ China trademark Classes 9+42 filed (¥540); US TEAS as needed
• ☐ All 12 account slots locked
• ☐ Domain email (hello@/support@) forwarding live
• ☐ DNS + SSL ready; Android applicationId finalized
• ☐ Incognito search of brand name returns only you → launch

Brand assets work counterintuitively: they're cheapest when you don't need them and most expensive when you do. ¥1,700 and three evenings to lock everything down two weeks before launch, versus ¥170,000 in lawyers to win it back after you blow up — same asset, two prices. Which one you pay depends on whether you're reading this guide or the enforcement one.