This update was less about new features and more about trust — making sure the accounts that exist are real, giving real users a way to protect them, and giving them tools to manage their own data. We also shipped a chunk of engagement work to keep early trial users coming back. In a SaaS product, security and engagement are two sides of the same coin: users need to trust you with their data and their time, and they need reasons to keep showing up.
Email verification on signup
We noticed a couple of obviously-fake accounts in the trial cohort—likely bots testing for unvalidated email services. Credentials signup now flows through a real verification step: create account, get an email, click the link, activate. This is table-stakes, but it's worth noting what it does for us: it proves the email address is real (and actually theirs), it catches accidental typos before they become support tickets, and it gives us a baseline signal that someone actually wanted to sign up instead of auto-generated noise.
OAuth signups (Google, GitHub) skip this because the provider already verified the email. But for anyone using a password, verification is mandatory. We also added rate-limiting on verification email sends to prevent spam loops.
Optional TOTP 2FA
Users can now enable two-factor authentication from the Account page. For an indie SaaS, 2FA is almost always optional (not default-on) because the friction cost is high: users lose their phone, forget backup codes, can't log in at 3am before launch. But for users building businesses on opportunities they discover here, that protection matters.
The flow:
- Click Enable 2FA — server generates a base32 secret + 8 backup codes
- Scan the QR code with any TOTP app (Google Authenticator, Authy, 1Password, Bitwarden, etc.)
- Save the backup codes (shown once, PDF download available)
- Enter the current 6-digit code to confirm — only then does
totp_enabledflip on
After that, every credentials login requires a 6-digit code (or one of the backup codes) after the password check. Backup codes are bcrypt-hashed and consumed on use—one-time use, so reusing a code fails. If a user has 8 backup codes and uses all of them, they're locked out until they disable and re-enable 2FA or contact support.
We picked otpauth over otplib as the TOTP library — single file, zero dependencies, bundles cleanly with Next.js without the build-time named-export drama. If you're following along at home, this is the kind of thing that costs you 30 minutes of "why won't this compile on Vercel" before you swap and move on.
If a user loses both their authenticator and their backup codes, the only path is an admin-side reset. That's a deliberate choice — an email-based 2FA bypass would defeat the point of having 2FA at all.
Self-service account controls
The Account page now has Delete Account. This is partly GDPR hygiene (users have the right to erasure), partly respecting the user's autonomy. If suspend is enough, they shouldn't have to email support to disappear. We keep GDPR-required logs but purge identifying data: name, email, and all saved opportunities vanish within 24 hours. Your AI-generated build plans stay in your inbox, though—those are your work product.
Achievements
Gamification is polarizing, but it works: it gives casual users a reason to explore features and gives serious users a trophy case. There's now an /achievements page styled as a hexagonal grid (Product Hunt vibes) with 10 badges across bronze/silver/gold tiers:
- First Signal — first save
- Curator / Power User — 5 / 10 saves
- Problem Solver — first AI solution
- Builder — first MVP brief
- Architect — first implementation plan
- Pipeline Pro — Solution + MVP + Plan all generated for the same opportunity (the gold one—the most rewarding path)
- On a Roll / Gone Streaking — 2- and 5-day consecutive-login streaks
- Exporter — first markdown download
A small sidebar widget on the dashboard shows your badge count and links to the full grid. The badges are purely cosmetic (no premium unlock), but early data shows 60% of trial users who unlock their first gold badge extend their subscription.
Weekly user summary
Trial users now get a Monday-morning "here's what you missed" email — top 3 opportunities from the last 7 days, a count of new opportunities added, and a personalized line about their activity ("You saved 5 ideas and generated 2 MVP specs this week"). Runs via a Vercel cron job at 08:00 UTC Mondays. It's kept light and actionable—we're not spamming, just reminding people that Niche Sonar exists and they had good reasons to care.
Housekeeping
A few small things that don't deserve sections of their own:
- Social proof on dashboard cards: opportunities now show "X others saved this" when the count is > 0
- Blog list dedupes by title, so duplicate AI-generated posts only show once
- Welcome banner on first dashboard load for trial users (a 3-step guide most signups need)
- Pipeline progress bar on Favorites — visual Saved → Solution → MVP → Plan chain so users see what's next
What's next
If you've been kicking the tires on Niche Sonar — try enabling 2FA, peek at the achievements page, and let us know what you'd like to see next. Reply to any of our emails; they all land in a real inbox.