What this property was
Avatarmatic generates AI avatars: upload a few photos, get back stylized portraits of yourself — professional headshots, fantasy characters, the whole genre that detonated across the internet when image models crossed the "recognizably you" threshold. It was my entry into one of the most legible product categories AI has ever produced: input selfies, output flattery, charge a few dollars for a pack. Hundreds of teams worldwide had the same idea in the same six months, and I was one of them.
Evidence recorded in the manuscript
Revenue: nothing I can point to with confidence. Time from idea to live: days, exactly as the category demanded. Competitors at launch: functionally unlimited. The number that matters most is from the incident: one live API key in one dead file, shared across dozens of apps — a blast radius out of all proportion to a product nobody visited. Security exposure doesn't scale with traffic; that's the terrifying part. The emptiest site on the server can leak the key that empties the busiest account.
The lesson recorded after launch
Two lessons, one per disaster class. Commercial: in a gold rush, a clone without a distribution edge is a donation to the category leaders — surf cheap waves only when you can name, in one sentence, why anyone will find yours. Operational: dead code is not neutral; it is unaudited attack surface wearing your credentials. Every abandoned experiment keeps whatever secrets you fed it, forever, unless you kill it properly.…