... absence would stop the product doing one of its functions. If your app is a thin client over your API, that API is not a separate service you can wave at. It's part of the product. This product-versus-service line is the genuinely contested bit, and I'm reading the Commission's guidance and a pile of law firm notes rather than a court ruling. I'm a founder, not a lawyer. If you're near the boundary ... ... ENISA's SRP FAQ. It's the operational one, it's updated regularly, and the last time it changed was 17 September, five days ago. The coverage is not going to tell you about the counter. Comment from Mona

... nobody covered, which is worse, because it changes a line of code a lot of us shipped this year without thinking about it. If your product has a "paste a URL" box, a link unfurler, an enrichment step, a competitor-monitoring job, or anything that fetches a page and hands it to a model, this is about you. What was actually measured. The paper is "Indirect Prompt Injection in the Wild" by Khodayari, Zhang, Acharya and Pellegrino, out of CISPA ... ... knew. One last thing. 65% of the pages in that dataset already contained their prompt 12 months before the analysis. This is not a new risk arriving. It's an old one you've been ingesting. Comment from Mona

... right and is more useful than either, and the revised version went up this month, so it's worth twenty minutes before you write your Q4 plan. It's NBER working paper 35275, Demirer, Musolff and Yang - "Writing Code vs. Shipping Code." More than 500,000 GitHub developers, matched against their actual AI usage telemetry rather than a survey, in a matched event study design. The headline numbers are large and I have no interest in arguing with them. Cumulative ... ... most want replicated by someone with no Microsoft relationship at all. And "releases" is a crude proxy for value - a team shipping fewer, larger releases isn't underperforming, it just looks that way in this data. Comment from Mona

... Apple's own support pages. Apple In-App Purchase: 26%, or 15% if you're in the Small Business Program, the Mini Apps or Video Partner Programs, or on an auto-renewable subscription after the subscriber's first year. Alternative payment processing inside your app: 20%, or 10% for those same groups. Out-of-app offers with an actionable link: a 15% store services commission, or 10% for those groups, on anything bought within 7 days of the tap. Apps ... ... distributed outside the App Store entirely - an alternative

... Three numbers from it get quoted. Users who saw an AI summary clicked a traditional result in 8% of visits; users who didn't, 15%. Users ended their browsing session 26% of the time with an AI summary present versus 16% without. And the one that should matter most to anyone buying GEO: users clicked a link inside the AI summary itself in 1% of visits. One per cent. That is the click value of the thing the entire optimisation ... ... more often. Just 8% of one- or two-word searches produced one. For searches of ten words or more, 53%. For searches starting with a question word - who, what, when, why - 60%. Sit with that next to the 8%-versus

... line appears in both: starting September 2026, you're required to indicate whether your app or game includes social media capabilities in order to submit new versions or updates to the App Store, or for notarization for distribution on alternative marketplaces. It's September. It's live. I read both pages this week rather than the coverage, partly because Murror is the kind of app where the answer isn't obvious, and partly because the second-order effects aren ... ... Yolanda S.(@yolanda_c_schneider): I like the distinction betweeen a social network and an app that simply lets users interact with content. My own definition of social media would probably be much narrower than Apple s. Comment from Mona

... times. I'm a founder, not a lawyer, and none of this is legal advice - but the arithmetic of which paragraph applies to you is something you can do yourself in twenty minutes, and it's cheaper than the alternative. Comment from Mona

... could have. And I still don't have a clean answer on the verification-method question, because the honest version is that I don't yet know what I'd do differently with a government-ID-checked 16 versus a self-declared one. I'd rather say that than write a paragraph pretending I've resolved it. The thing I am confident about is narrower. The signal is sparse for a long while yet. Texas only covers accounts created after ... ... refreshing the set from actual refusals in the logs, so users decide what counts as an edge instead of us guessing. Still nothing for the route that gets looser on something no one has tried yet. Comment from Mona

... categories on purpose, and write down why. Not because Cloudflare's defaults are wrong, mostly they're reasonable, but because a default you never chose becomes a strategy by attrition. This one has a date on it. Comment from Mona Truong(@monatruong_murror): @serdarships  Varying the client is the axis I'd have missed entirely, and it's the more dangerous one. A path that behaves differently by header isn't a bug you can find by walking ... ... glance rather than a record. Which leaves the gap-diff you described as still the right instinct, just with worse tooling than it deserves. Comment from Omri Ben-Shoham(@omri_ben_shoham1): Good writeup - the distinction between blocking Training vs

... spent this week on the directories and the thing that decided visibility was not content at all. wrong category on capterra and you are invisible to anyone browsing, findable only if they already know your name. Comment from Mona Truong(@monatruong_murror): @jernej_jan_kocica  The permanence is the part I didn't know, and it changes the order of operations. If a declined category can never be requested again, the submission is the whole decision so the work ... ... Murror best rather than the one that exists, and burned the attempt on it. Hope the pending one lands. Did they tell you the never-again rule upfront, or did you only find it after the decline? Comment from Mona

... destination? If the value is a result someone wants and doesn't care how they got an action then being agent-callable is close to free distribution and you should be looking hard at it before your competitor does. If the value is the experience of a person actually being there a destination then racing to become a tool call is optimizing for a future where your product's whole reason for existing has been abstracted away. Worse ... ... server fastest. They'll be the ones who were honest about whether they should and, if they did, treated that borrowed trust like it was hard to get. Because it is. Comment from Gal Dayan(@galdayan): the action vs

... small it moved onto exactly one desk. Comment from Ill Robyn(@ill_robyn): The idea of treating review as a budget really stands out. Asimple rule like that could stop AI generated work from piling up unnoticed. Comment from Mona Truong(@monatruong_murror): @ill_robyn Thanks and the reason it ended up as a budget rather than a rule is that I failed at every stricter version first. "Always review AI output" has no partial credit: the first week ...

... late, or produced an output a user cannot trust enough to act on. The eval set that ends up mattering is usually a small pile of real sessions tagged by failure mode rather than benchmark name. Comment from Mona Truong(@monatruong_murror): @getosmo  "Tagged by failure mode rather than benchmark name" is the line I wish I'd written. That's the whole thing. Once the cases are organized by how it breaks, the set stops being a scorecard ...

... pricing metric rewards the behavior your actually want from users . If the metric can grow because the user is struggling more, it's probably measuring the wrong thing. That's a useful lens far beyond AI companions. Comment from Mona Truong(@monatruong_murror): @joseph_walker2   Thanks for reading it that closely. That's exactly the test I now run before shipping any plan: would this number go up if my users were having a worse week? If the answer ...

... Mona, a marketer turned founder from Germany. I'm building Xolora, a marketing analytics tool dedicated to solopreneurs and small business owners. I noticed that 80% of that niche is overwhelmed with their marketing and just guessing. When it comes to ads, this means that they're wasting money (around $10,000/year). And the sad truth is that there is no tool out there, that helps them. All the other marketing tools are made for marketers or big teams ... ... underserved niche. Xolora's goal is to simplify ad analytics, give back time, money and ultimately confidence. It just launched in beta and I hope that it will be valuable for its users. What is your niche? Comment from Mona

... judgment, your ability to stay steady when the feedback is loud and instant and mostly noise. In 2026, taking care of the builder is not self-help fluff. It's the actual bottleneck. Treat it like one. Comment from Mona Truong(@monatruong_murror): @omri_ben_shoham1   The recovery is exactly where mine used to fall apart too, and the fix was killing the streak entirely. There's nothing to break. It's not a chain I'm protecting, just ... ... pick it back up next day, or is there some catch-up rule? that's usually where these systems fall apart for me, not the routine itself but the recovery after the first missed day. Comment from Mona

... this: if building is no longer the moat, then the moat is available to anyone willing to do the unglamorous work. Knowing your person. Owning a relationship instead of renting attention. Being early to a workflow before a competitor gets embedded in it. None of that requires funding or a team. It requires you to stop hiding in the part of the work that feels productive and go do the part that actually decides whether the thing lives. Ship ... ... later, after I had a few users, answering the exact questions they asked me. Fewer posts, aimed at stuff people were already searching. Thanks for writing this, the after-launch part is the part nobody posts about. Comment from Mona

... best day, on a task you made up. Your users meet it on an average day, on the task they actually have. Build for the average day. That's the whole game now. Comment from Mona Truong(@monatruong_murror): @magdalena_anderson   Yeah the first time we graded the model on ten real, messy sessions instead of a clean benchmark, the number dropped hard, and that drop was the most useful thing we learned all quarter. The public score describes ... ... task none of your users are actually doing. One thing that surprised us: half the value was just re-reading the transcripts ourselves, before we even scored anything. Comment from Mona

... inside your app if they can only feel understood while they're talking to your model you haven't solved loneliness. You've made it more comfortable to stay lonely. You've built a very sophisticated waiting room. The alternative is to design for the exit. Concretely, that means three things. Point users back at real people, not deeper into the app. The most valuable thing an emotional AI can do isn't be a better listener than your friends ... ... gating anything behind it) rather than trying to infer intent from behavior. a noisy signal at 40% response is more useful than a clean-looking proxy at 100% coverage that's quietly measuring the wrong thing. Comment from Mona

... which one were you actually optimizing for? Comment from Nika(@busmark_w_nika): imo, the whole thing with AI agents is becoming oversaturated the same way as it was with AI in 2024 Comment from Stacy Wycoff(@stacywycof83995): Mona, this is the question I keep circling back to while building FounderFlow. My honest answer is uncomfortable, I want usage to go down over time, not up. If it is doing its job, a founder should need fewer of my alerts ... ... like proof of value to an investor, but for the actual founder using it, quiet is the win. How are you thinking about measuring a product that is supposed to make itself less necessary? Comment from Asad M.(@asadmalik901): Mona

... refuse to build, even when users are asking for it and the metrics say yes. Anyone else held the line on a feature like this? Curious how you explain the "no" to users who genuinely want it. Comment from Mona Truong(@monatruong_murror): @khaildnaseem  We've thought about this a lot, and it's the most tempting version of the idea. The problem we kept running into is that "after writing" is exactly when the reflection has the most ... ... with a shortcut to skip the payoff. That said, we are exploring lighter ways to help people explore after they write just not through conversation. Comment from Asad M.(@asadmalik901): @monatruong_murror   This made my day, thank you Mona

... animation and 8 seconds of silence. Our engineer thought it was a bug when he first saw the spec. "You want me to add... a delay?" Yes. On purpose. Here's why. We ran an experiment: instant AI response vs. an 8-second pause before the same response. The content was identical. The only difference was time. Users who got the pause rated the AI's reflections 40% more helpful. Same words. Same insights. They just felt more considered ... ... user has a second to sit with what they just wrote before getting a response back. the pause does something to the user's own processing regardless of what they believe about the AI side of it. Comment from Mona

... that you don t need to understand your own codebase deeply to build something people love. You just need to understand the problem. Anyone else navigating this weird middle ground? Comment from Omri Ben-Shoham(@omri_ben_shoham1): @Mona Truong "diagnostic questions instead of reading code" is basically a new skill in its own right though, and probably a harder one to teach a team than code review ever was. do you know yet whether it transfers - like if someone ... ... what could cause this to fail" on this feature, does that skill carry over to a totally different part of the codebase, or is it more tied to how well they know this specific feature's behavior? Comment from Mona

... journaling and therapy tools plateau. People filter themselves the moment they think something will be remembered forever. Deliberate forgetting turning into a trust signal is one of those design lessons more AI builders need to sit with. Comment from Mona Truong(@monatruong_murror): @advin_jadis  yes and the data surprised us. users do pin, but not the way we expected. early data shows pinning is mostly a one-time "this matters" gesture rather than bookmarking for later. about ... ... core idea the forgetting makes the present moment feel more meaningful, and pinning is how users honor that feeling. we're watching whether pinning habits shift as users get more comfortable with the 30-day cycle. Comment from Mona

... Every time we push information at users, engagement drops. Every time we let them pull it when they're ready, it goes up. Has anyone else found that making AI less visible actually made it more valuable? Comment from Mona Truong(@monatruong_murror): @ilyaofliian   Really appreciate you naming it -- "chilling effect" is exactly the right framing, and honestly we hadn't connected it to that body of research until now. The privacy-by-design angle is spot ... ... feeling? Comment from Gal Dayan(@galdayan): @monatruong_murror  that opt-in rate over time is the metric I'd watch too - it's basically a leading indicator for the fatigue before it shows up in journaling quality. curiosity vs