Someone Copied Your Vibe Project: Evidence, DMCA & Platform Takedowns

Last month, an indie developer posted on V2EX: the AI bookkeeping app he'd spent three weeks building had a pixel-perfect clone by its second month — same colors, same copy, even the same typos he'd made casually, just under a different name, listed for sale. The top comment read: "Don't rant yet. Did you preserve evidence?"

Those words name the most common mistake vibe developers make after being copied: rant first, preserve evidence later — in the wrong order. You call them out online, they take everything down and vanish, and you're left with no timestamped evidence chain — just anger. Worse, vibe projects are born easy to copy: AI-generated UIs look alike, code structures are predictable, and many projects never even picked a license (which means "all rights reserved" that nobody knows about).

This guide covers the complete post-copying playbook. First, a disclaimer: this is not legal advice; consult a licensed attorney for your specific case. What this gives you is an action framework — what to do first, what comes next — plus the cost math for each step, so you can play the right sequence even at peak emotion.

Handle the emotion before handling the case. The rage you feel upon discovering a copy is normal, but rage is the most expensive emotion: it makes you skip assessment and rant, skip preservation and call them out — every step destroying your own leverage. Set a rule: no public action within 4 hours of discovery. Those 4 hours have one job: fix the evidence per section 2. After 4 hours the rage fades and the evidence stays. That restraint is worth more than everything that follows. Years later you may find the real harvest of being copied was being forced to build complete IP asset awareness — registrations, trademarks, notarization — things you'd have to do eventually; being copied just moved the schedule up.

One baseline judgment first: not every resemblance deserves enforcement. Two situations call for walking away: ① they only borrowed your product idea (ideas aren't protected by copyright — iron rule); ② they're ten times your size and enforcement costs dwarf your capacity (see section 8, "when to walk away"). Enforcement is a means, not an end — the goal is making the copier pay or stopping your losses. If the main cost is your own time and money, you lose twice.

Copies come in three common shapes, each with its own playbook: ① wholesale clone (reskinned and launched, direct competition) — full arsenal: complaints, legal letters, registrations; ② code theft (your open-source code used commercially against the license) — lead with license violation, GitHub DMCA works fastest; ③ brand impersonation (name/domain/app-store name squatted) — lead with trademark, see section 6. Identify your shape before picking weapons; don't go looking for nails with a hammer.

The four phases at a glance (see the whole before the details):

1. Assess Before You Fire: Where Borrowing Ends and Copying Begins

Courts generally test copyright infringement on two prongs: access + substantial similarity. "Access" means the other party could have seen your work — if your project was publicly released, that prong is essentially automatic. "Substantial similarity" is the battlefield, judged on three dimensions:

• Code: straight copy-paste is the easiest to prove. Run a code-similarity tool (MOSS-style text comparison); similarity above 70% that includes your "personal expression" — distinctive variable names, comment style, even bugs you left — is close to conclusive. Caveat: AI-generated boilerplate (standard CRUD templates) is naturally similar everywhere; exclude the generic parts and compare only the non-generic ones.
• UI: judge the "overall visual impression," not individual elements. Button radius, color scheme, layout rhythm, icon style — none protected alone, but the combined resemblance counts as evidence. Pixel-perfect cloning (same typos and all) is the strongest evidence, because "independently creating the same typo" doesn't survive probability.
• Copy: landing page text, error messages, onboarding strings — literary works get the strongest protection. If they copied your slogan, that's a gift.

The other side's favorite defense is "independent creation": claiming they never saw your project, it's coincidence. One counter — the timeline: your release predates theirs, with git history, app-store listing dates, and Wayback snapshots forming a complete chain. "Coincidence" then collapses. That's why section 2 (evidence preservation) must come first: the timeline is your only weapon.

Vibe projects have a special wrinkle: ownership of AI-generated code is itself contested. If your core code is AI-generated, their lawyer may challenge your copyright in it. Practical advice: ① keep evidence of your "substantial rewriting" (prompt logs, multi-iteration version history proving your intellectual input); ② UI design, copy, and product architecture — the high-human-authorship parts — are your main enforcement ammunition; ③ this cross-links the AI-code license risks guide — sloppy input-side compliance costs you cards on the output side.

Budget 1–2 days for assessment, never more than a week. Get 1–2 peers to review (bystanders filter your emotional markup). Only three conclusions: ① confirmed copying → section 2; ② borrowed idea → walk away (or learn from what they did better); ③ unsure → preserve evidence first (preservation is nearly free, don't hesitate), then consult a lawyer.

The other side may also play the "fair use" card: claiming educational, commentary, or research purpose. Counter on four factors — purpose of use (commercial use is nearly dead on arrival), proportion used (copied 80% and still claiming fair use?), market effect on your work (direct competition is the kill shot). Fail two of three and "fair use" collapses. If it reaches court, the court may order a copyright forensic examination (available from bodies like China's copyright protection center, costing thousands); the examination opinion is the hardest evidence of "substantial similarity" — which is why section 2's comparison PDF is essentially you doing a "pre-examination" yourself, so you know whether the money is worth spending.

There's also a stealthier copy: stealing your idea and having AI rewrite the code. Code-similarity tools score low, but the UI, interaction flows, and copy are identical. The code dimension is weak here, so lead with UI + copy — "AI paraphrasing" doesn't change the access-plus-substantial-similarity test; the cleaner the wash, the more it proves they studied your work (how else would they know what to wash?).

2. Preserve Evidence: the Order Is Non-Negotiable

Preserve first, contact them second, go public third. This order is iron law. The anti-pattern: you call them out on X, they take every page down in 10 minutes, and your evidence is a few screenshots — screenshots with no timestamp proof, met with "those are photoshopped," and you're done.

The preservation checklist (prioritized, finish within 48 hours):

• Their infringing pages: archive the whole site. Trigger a manual Wayback Machine (web.archive.org) snapshot for a timestamped archive link; simultaneously do full-page screenshots + screen recordings yourself (URL bar and system clock visible). Record in one continuous take — no cuts.
• Your originality evidence: export git history (git log --all --full-history), screenshots of app-store/platform listing dates, earliest user feedback or posts (with timestamps), design source files (with creation metadata). Goal: prove "I was first" as a complete timeline.
• Side-by-side comparison: put both codebases/pages side by side, marking the non-generic similarities (distinctive names, identical typos, identical comments). Make it a PDF — judges and platform reviewers both love this kind of visual.
• Third-party notarization (optional but recommended): in China, blockchain evidence platforms can notarize infringing pages for tens of yuan, carrying more weight than plain screenshots; for serious cases, a notary office's webpage notarization is strongest.

The easiest preservation mistake: preserving "they copied" but not "who they are." Fix their operating identity alongside: website ICP filing number, app-store developer name, social media account pages, WHOIS records. They can change all of this at any moment; after the change you won't even know whom to sue.

One more thing most people miss: before messaging them about anything, preserve everything outside the chat logs. Once you contact them, they know they're watched, and evidence destruction will outpace your imagination. The order is forever: preserve → legal letter/complaint → go public (if needed).

A technical detail of electronic evidence: hash values. Compute a SHA256 for every preserved file and write it down. When they challenge "your screenshots are photoshopped" in court, you produce the hash from preservation time plus the original file — matching hashes prove no tampering. Blockchain notarization platforms do this automatically; doing it yourself, one sha256sum run takes 5 minutes and can save 50,000 words of argument later.

Trusted timestamping (TSA) is another cheap tool: submit a file hash to a trusted timestamp service for proof that "this file existed at this point in time," tens of yuan. Its weight sits between plain screenshots and notarization — good for "keeping an option open." The ultimate bar for preservation: make the judge believe "this evidence looked like this at time X and hasn't been altered" — time plus integrity, both required.

What if they're overseas? Check their platform first: GitHub/Google/Cloudflare are US companies that honor DMCA (section 4) regardless of where the infringer sits; app stores have global complaint channels; search de-indexing works globally too. The truly hard case is "self-hosted in some small jurisdiction, ignoring everything" — then assess their traffic sources: if Google-driven, de-indexing kills ~80%; if social-driven, report their accounts. Genuine "lawless zones" are rare; most copiers depend on a few big platforms for traffic — choke the platform, choke the lifeline.

3. The Four Platform Complaints: Takedowns Without a Lawsuit

Ninety percent of copy disputes never reach court — platform complaints resolve them, because platforms face safe-harbor pressure and will take down first on a valid infringement notice. The four, ordered by speed:

1. GitHub DMCA (their code is hosted on GitHub). Fastest — usually 24–48 hours. Use GitHub's DMCA form: state your original repo link, their infringing repo link, and exactly which files were copied (precise file paths — don't just say "the whole project"). GitHub's process is disciplined; complete materials almost always get the repo taken down first. See section 4 for the DMCA deep dive.

2. App-store complaints (they listed an app/mini-program). App Store via Apple's copyright channel, Google Play via Google's DMCA form, WeChat mini-programs via Tencent's infringement platform. App-store takedowns hit hardest — they cut the revenue directly. Attach your software copyright registration certificate (section 5) for a much higher pass rate.

3. Search de-indexing (cut their traffic). Google Search's legal-requests form, Bing's copyright complaint, Baidu's infringement channel. After de-indexing their site still exists but can't be found — for copiers living on search traffic, this pulls the rug out. Many people complain to platforms but forget search engines; the copier then switches domains and ranks #1 again.

4. Social and content platforms. They're promoting the clone on X/Xiaohongshu/Bilibili? Every platform has a copyright channel. Especially when they use your screenshots/videos as promo material — near-100% success rate, because no platform tolerates your work advertising their product.

Three rules for complaint language: ① state facts only, no insults ("the other party copied" becomes "the other party's pages bear substantial similarity to our work; see attached comparison"); ② attach section 2's comparison PDF and timeline; ③ leave correct contact info — platforms may ask for follow-up materials, and silence for 48 hours counts as abandonment. You can file the same infringement on multiple platforms simultaneously; no conflict.

Bookmark the entrances now (current as of 2026; search "[platform] copyright complaint" if moved): GitHub via site footer "Contact" → "DMCA"; App Store via Apple's legal requests page → "Copyright"; WeChat mini-programs via "WeChat Public Platform → Infringement Complaint"; Google Search via "Google legal troubleshooter" → "Copyright" → "Search." Put all four in your bookmarks — when the day comes, you won't want to hunt for entrances while emotional.

If a complaint is rejected, read the reason first. Most common is "incomplete materials" (missing ownership proof, imprecise URLs) — supplement and resubmit. Next is "not infringement" (the platform sees mere idea similarity) — then revisit section 1's assessment; if the platform doesn't see it, a court probably won't either. Consider walking away. And never resubmit the same materials to the same platform repeatedly — you'll be flagged for abuse. Switch channels (GitHub rejected → try the app store); don't batter one door.

Set realistic timelines per channel to avoid anxiety: GitHub DMCA 24–72 hours; app stores 3–7 days (Apple slowest, human review); search de-indexing 1–2 weeks; social 1–3 days. Past due with no movement? Check spam first (platform follow-ups love the spam folder), then supplement once. And don't stop shipping your own product during complaints — many developers freeze everything to fight, winning the fight and losing the product. Remember section 8's math: your time is the most expensive cost.

4. DMCA in Practice: the Five Elements and Counter-Notices

The DMCA (Digital Millennium Copyright Act) is US law, but its notice-and-takedown mechanism is the de facto standard of the global internet: GitHub, Google, Cloudflare all play by these rules. Learn it and you understand half the internet's takedown logic.

The five elements of a DMCA notice (missing one can get it bounced):

• ① Your identity (name/company, address, phone, email) — must be real; false info carries perjury liability;
• ② Description of the infringed original work (with links: your repo/site/listing);
• ③ Location of the infringing material (precise URLs, ideally file paths);
• ④ Good-faith statement: "I have a good faith belief that the use complained of is not authorized by the copyright owner" (standard language — copy it);
• ⑤ Accuracy statement + electronic signature: "the information herein is accurate and I am the copyright owner or authorized to act," then sign your name.

What happens after filing: the platform typically removes the infringing content within 24–72 hours of a valid notice and informs the other party. They have two options: accept it (most cases end here), or file a counter-notice. Don't panic at a counter-notice — it's their statutory right, usually claiming "no infringement / fair use." After receiving it, the platform forwards it to you and starts the 10–14 day rule: if you haven't filed a court action within 10–14 business days, the platform restores their content.

So a counter-notice is essentially "sue me or drop it." Response playbook: ① get a lawyer's assessment on receipt (many offer 30-minute free consults — enough to judge whether to sue); ② if evidence is solid and damages justify it, file within 10 days (even just filing blocks restoration); ③ if the assessment says it's not worth it, accept the restoration but log the lesson — at minimum you made them sweat, and next time they copy someone they'll think twice.

One rule people miss: the repeat-infringer policy. The DMCA requires platforms to terminate users with multiple infringement strikes. So if they're a serial copier, your complaint enters their record — enough strikes and the platform bans the account outright. Even when this round doesn't hurt them, your complaint paves the road for the next enforcement (yours or someone else's). Filing is never wasted.

Final warning: a DMCA notice is a formal legal document with perjury liability. Bad-faith filings (complaining when you know there's no infringement) expose you to countersuits — and courts have awarded damages. That's why section 1's assessment can't be skipped — when unsure, consult a lawyer first; never use DMCA as a quarrel tool.

The flip side: if your vibe project has UGC (user-uploaded content), you're the "platform," and you need the DMCA's other face too: designate a DMCA agent (register a receiving email at the US Copyright Office — $6) and put an infringement-complaint entrance on your site. Then when someone complains about your users' uploads, following notice-and-takedown keeps your safe harbor — delete fast, and you're not liable for users' content. Many indie developers miss this: a user uploads a pirated movie to your server, the rightsholder sues you directly, and you can't even say "I didn't know." For any UGC project, that $6 is mandatory spend.

5. Copyright Registration: Small Money, Big Leverage

Many believe "copyright is automatic on creation." True — but registered and unregistered copyrights are two different weapons in enforcement.

China: China Copyright Protection Center (ccopyright.com.cn). Software copyright registration is standard kit for indie developers: ¥300–500 via an agent, 30–40 working days (expedited ~10). With the certificate: ① app-store complaints with it attached pass far more often; ② in court it's prima facie ownership evidence — the other side needs earlier evidence to overturn; ③ some local governments subsidize registrations or count them for talent programs — a bonus. Recommendation: register every project you formally launch. It costs less than a dinner.

US: the Copyright Office (copyright.gov). Online registration $45–65, takes months (expedited available). The key point: registration is a prerequisite for suing for copyright infringement in the US — unregistered, the court won't hear your case. If your project serves overseas users or the infringer is US-based, this registration is mandatory. Note: US registration requires depositing a "work sample" (first and last 50 pages of source, or a redacted full copy) — strip keys and secrets before submitting.

Timing: register at launch, not after being copied. A US subtlety: registering within 3 months of infringement vs. before it changes what remedies you can claim (statutory damages and attorney's fees require "timely registration"). China has no such rule, but registering after the fact means a 30-day cycle during which the copier may have cashed out and run.

Beyond software: UI mockups can be registered as artistic works (for pixel-perfect clones), product copy as literary works. Two or three registrations per project, under ¥1,000 total — an evidence arsenal for enforcement. The best-value insurance an indie developer can buy.

If registration is rejected or needs correction: software copyright's most common correction is "non-conforming identification materials" (wrong source format, insufficient pages) — fix per the notice, usually free. Rejections are mostly "not a software work" (pure data, pure algorithms) — refile those as literary or artistic works. Remember: registration review checks form, not substance — it doesn't judge whether your code is good, only whether the paperwork is complete. Rejection is almost always a paperwork problem; fix the paperwork, don't question your life.

Open-source code used commercially against its license is the most infuriating copy for vibe developers: you MIT-licensed it, they took everything but stripped your copyright notice — that violates even MIT. Playbook: ① confirm they actually breached the license terms (MIT only requires keeping the notice — kept it, no violation, don't friendly-fire); ② GPL code used in closed-source commercial products is both license breach and infringement — cite both in the letter, doubling deterrence; ③ GitHub DMCA applies equally. Open source isn't giving up rights; it's exercising them differently — the license is your weapon. Choose it deliberately, wield it when needed.

6. Trademarks & Names: When You're Squatted

Code theft steals the inside; name theft steals the face — and hurts more. Your product name gets trademark-squatted, domain-squatted, app-store-name squatted. What then?

TM vs. ® first. ™ is self-declared — "I use this as a trademark" — with zero legal force. ® marks a registered trademark. Many indie developers slap ™ on their product name and feel protected. They're not. To actually protect a name, register the trademark.

China trademark practice: file via the Trademark Office site or an agent (agent fees ¥500–1,000 — worth it over guessing classes yourself). Key points: ① pick the right classes — Class 9 (software) for apps, Class 42 (tech services) for SaaS; filing both is safest; ② search first — check for similar marks on the Trademark Office site before filing; wasted fees are minor, wasting half a year on a rejection is the real cost; ③ the cycle is 8–12 months, so file when the name is decided, not when you're big — discovering a squat after you're big is one of the most expensive lessons in indie development.

Already squatted? Three paths: ① if the squat is under 3 years old and unused, file "cancellation for three years of non-use"; ② if it's bad-faith squatting (e.g. by your competitor), file opposition/invalidation — you'll need evidence of your prior use (launch date, user numbers, press); ③ buy it back — many squats exist to be sold; a few thousand yuan usually beats a lawsuit. The test: what the name is worth (rebrand cost: domain, SEO, user recognition) decides fight vs. buy.

Negotiating a squat buyback: never reveal you're the original brand — have an intermediary inquire first. Once they know you're the "owner," the price triples at minimum. Get the quote, then reveal and negotiate — saves half. Use escrowed transactions (Sedo/aliyun domain marketplace for domains, agency transfer process for trademarks) — never wire directly. Pay the tail only after transfer completes and the transfer certificate issues.

Domain squats: go the UDRP (Uniform Domain-Name Dispute-Resolution Policy) via WIPO or the Asian Domain Name Dispute Resolution Centre. Three elements: the domain is identical or confusingly similar to your trademark, the holder has no legitimate interest, and bad-faith registration and use. Takes 2–3 months, ~$1,500. Decent success rate — but it presupposes you have a trademark. Which circles back to "register first."

Defensive advice: once the name is set, grab the .com and same-name accounts on core social platforms (X/GitHub/WeChat official accounts/Xiaohongshu) — near-zero cost. That's "brand asset squatting," cross-linking the custom-domain & DNS guide — the domain is the brand's first wall.

Don't forget monitoring after registration. The Trademark Office site lets you periodically check for similar filings; oppose similar applications within their 3-month publication window — opposition costs a tenth of post-registration invalidation. Trademark watch services (a few hundred yuan/year) are worth it if the name matters. Most squats happen while you're not looking; discovering one after their certificate issues multiplies enforcement cost fivefold. Like domains, trademarks are "claim early, sleep well" assets.

7. The Prevention Stack: the Best Enforcement Is Never Needing It

Enforcement, however cheap, costs more than prevention. The four-piece prevention stack, all done before launch:

1. Pick the right license (open-source projects). This is the core of cycle77's open-source release guide; here only the enforcement angle: the wrong license costs you a card at enforcement time. MIT permits commercial use — someone selling your code under a new name leaves you no recourse (you permitted it). The GPL family's "copyleft" makes closed-source commercial distribution a violation — one more card. AGPL counts "cloud service" as distribution — anti-cloud-freeloading. When choosing, decide: maximize spread (MIT), or keep enforcement leverage (GPL/AGPL). No right answer, only trade-offs — but no license at all is the worst choice: default "all rights reserved" with nothing in writing.

2. Copyright notices & watermarks. © 2026 XX. All rights reserved. in every page footer, a LICENSE file in the repo, a subtle identifier in API responses. Watermark images/videos (see the watermark anti-scraping guide). These don't stop copying, but they kill the "I didn't know it was copyrighted" defense — "not knowing" mitigates damages in many scenarios, and the notice blocks that exit.

3. The limits of code obfuscation. Frontend code can be obfuscated (Terser, JS obfuscators), raising the cost of direct copying. But be clear-eyed: obfuscation stops the lazy, not the determined — anyone serious can reverse it. Its value is "raising copying cost" until "easier to just write it" — combined with your shipping speed (you iterate weekly; their copy is always an old version), copiers naturally fall behind.

4. IP clauses in your Terms. Add two lines to your Terms of Service: ① user-uploaded content must not infringe (allocate UGC liability upfront); ② no scraping, bulk copying, or mirroring. At enforcement time, that's your "breach of contract" basis. Template-reference the pre-launch legal trio guide — IP clauses are the fourth piece beyond that trio.

The prevention stack's ultimate form is shipping speed. Copiers snapshot; you livestream — iterate weekly and the copied version is always two releases behind; users vote with their feet for the original. A vibe developer's deepest moat isn't law; it's an iteration speed copiers can never match.

One more for open-source projects: a CLA (Contributor License Agreement). If you accept external PRs, have contributors sign a CLA (GitHub's cla-assistant bot does it), clarifying copyright ownership of contributions. Otherwise one day a contributor says "that part is mine, I'm revoking the grant," and your enforcement foundation cracks first. Cycle77's open-source release guide didn't expand on this in its community-files quartet — filling the gap here: for projects accepting external contributions, CLA matters as much as LICENSE.

8. Settle vs. Sue vs. Walk Away: the Cost Math

At this stage, look at the chart first — cost/time/success-rate across the three paths:

Path 1: Settle (right for ~80% of cases). Cheapest, fastest. Flow: legal letter → negotiation → settlement agreement. A legal letter isn't "a scare" — it's formal legal communication. Template below (have a lawyer adapt it, $50–80):

Legal Letter (key points)
To: XX Company / XX
Our client XX is the copyright owner of "XX" (link).
Comparison shows your product "XX" (link) bears substantial similarity
to our client's work in the following respects: (list 3–5 hardest points,
with comparison exhibit numbers)
Within 7 days of receipt, please: 1) take down the infringing content;
2) commit in writing to cease infringement; 3) negotiate compensation
for gains already made.
Further legal action will follow absent timely response.
XXX, Attorney at Law, XX Law Firm
Date

Negotiation leverage, ranked: takedown (mandatory) > attribution/apology (optional) > damages (situational). For indie developers the sweetest outcome is usually "takedown + token damages" — don't drag talks three months for an extra $700. Your time is worth more than that.

Four mandatory settlement clauses: ① admission of the infringing facts (however softly worded, "used our work without permission" must appear — without it the deal is hollow); ② takedown scope + deadline (specific URLs and package names, within 7 days); ③ a no-further-infringement promise + liquidated damages ($7k–15k, for deterrence); ④ confidentiality (damages confidential, but "they took it down" may be stated publicly). Have a lawyer review — $70–150. The biggest hole in DIY settlements is "they took it down but relaunched under a new skin" — the liquidated-damages clause exists precisely for that.

Path 2: Sue (solid evidence + damages justify it). A Chinese copyright suit: 6–12 months first instance, attorney fees from $3k–7k (contingency can be negotiated as "small retainer + win cut"). Before filing, do the math: their gains, your losses, litigation cost. If they're a shell company (many copiers are), you win and collect nothing — investigate their entity first, then decide. Jurisdiction: generally the defendant's domicile or where infringement occurred; internet courts (Hangzhou/Beijing/Guangzhou) support online filing, friendly to cross-region enforcement.

How contingency ("pay if we win") actually negotiates: $700–1,500 base + 15%–30% of collected winnings. Harder evidence and a richer defendant mean better ratios. Two notes: ① contingency only works for cases "with collectible assets" — shells need not apply, lawyers aren't naive; ② write into the contract whether mediation/settlement counts as a "win" — many cases settle pre-trial, and undefined terms breed a second fight over the cut.

Path 3: Walk away (cutting losses is wisdom too). Three situations: ① they only borrowed the idea (not infringement anyway); ② enforcement cost > 2× expected recovery (an indie developer's time is the dearest); ③ they're in an unreachable jurisdiction with no platform presence (no complaint channel, lawsuit can't reach). Walking away isn't surrender — it's saving bullets for more important fights. Spend the enforcement time shipping; the copier's copy stays an old version forever.

One last rule: going public is the last resort, not the first move. The order is forever: preserve → complain/send letter → negotiate → (talks dead) then consider going public. Going public first has three risks: they destroy evidence, they countersue for defamation, the crowd turns ("is he just farming outrage?"). The right way to go public: conclusive evidence + clear demands + facts only, never emotional venting.

This guide is an educational action framework, not legal advice. Consult a licensed attorney for specific cases.