c/build

Duration May - Aug 2026My Background: I am a founder of multiple SaaS company. Most recently i am building a AI native ticketing system for support platforms, simply put it takes your issues coming from Github, Discord, Forum or email and have a AI agent run through all the sources and generate a reply that is posted back. Pricing is tier based with a freemium model, direct signup, without demo.Marketing Strategy for X: We started marketing using text and image based post, with our website link put as CTA or the blog (medium) link.Total spending: We spend Around $3,509 for the entire 4 months.Audience: We narrowed down our audience , starting from targeting globally to focusing on Tier 1 markets especially as they have normally have higher rate of subscription buying.Results according to X own numbers: 46M impressions and 26K+ link clicks.Compare with our own website tracker (Matomo): Twitter 613 visits 885 actions 1.4 actions per visit 50s avg. time on website 74% bounce rateActual Signups: Consider it near zero, no actual follow ups, or growthMy observation: For each post there are crypto bots, and random bots that engage with the post, resulting in fake engagement and clicks. This platform strategy bring little or no value for our business.

I'm hearing that ServiceNow are pushing enterprise towards self-hosted for their next renewals.I get the impression that the main driver is an inability to service the necessary compute to deal with the avalanche of agents hitting their APIs.Kind of an interesting turn given that the main driver for many large enterprise to get off Remedy was the promise of removing multi-million dollar upgrade cycles because "dw it's saas, you cant customise and screw it up".Are other's seeing similar swings in enterprise software renegotiations?

I'm an engineering undergrad considering pursuing a PhD with the long-term goal of founding a hard-tech startup. I’m undecided about the specific area and only have a vague sense of what interests me -- industrial decarbonization, mining / mineral processing, and advanced materials are a few areas that currently seem exciting.However, I'm unsure which type of PhD lab would provide better preparation: either a problem-first lab (e.g., like Yet-Ming Chiang at MIT) or a technology-first lab (e.g., your typical academic lab that focuses on novel science without a predetermined application, and where commercialization happens largely by chance — when a technology happens to have a valuable market application).I've looked at advice online from successful hard-tech entrepreneurs, but the answers are conflicting. Some say to work backwards from a problem, but others argue that problem-first approaches often don't work since deep tech is inherently different: you often can't force a scientific breakthrough for a predetermined problem. Instead, they argue that most hard-tech companies are only founded because somebody made a scientific breakthrough and realized afterwards that there might be a commercial application. Indeed, the VC firm Pillar VC says that most deep-tech companies they know were "technology-first."With that in mind, does anybody have any advice on which type of PhD lab to join?

TL;DR I'm looking for advice regarding browser-based frontend development from people with practical e-ink UI experience. My specific device is a Bigme Hibreak Pro BW but I'm aiming for relatively broad compatibility.I've recently switched to a black-and-white e-ink smartphone with the motivation of withdrawing from the attention economy somewhat and it's a genuinely cool piece of hardware. While the majority of my needs are met by this device there are a few things I'd like to have which don't work terribly well with the e-ink screen. I'm planning to implement a couple of projects to fill these gaps, at the moment I'm planning a Lemmy frontend and an OpenRouter frontend specifically for e-ink. Both are to be browser-based rather than native, to maximise compatibility and because I'm much more familiar with the web than Android development.I would like to study the principles of sound e-ink UI design before approaching these projects to avoid creating unusable slop, in particular I am not entirely sure how to approach treating the refreshes as a first-class aspect of the design when I can't control them from the browser, and how to apply comprehensible UI conventions when a greyscale, high-contrast display is the target.Some specific problems I have out of the gate are:* Streaming LLM output to the screen is basically the worst-case scenario for e-ink, I need to buffer it and paint it in chunks without this becoming horrible to use.* Ghosting is a serious problem, browsing HN on the device is a particularly obvious example. Ideally I want to avoid scrolling as far as possible and rely on pagination instead, which I feel has the potential to become annoying if not done well.* Given I must rely exclusively on layout and type to carry the UI, what design languages emphasise these qualities best? My gut says the early Mac OS versions wouldn't be a bad place to start, this seems relevant given the display constraints of the early macs.I would greatly appreciate any advice on the design and implementation of e-ink UIs from people with practical experience in this area. This is purely to scratch a personal itch, once they're nailed down I'll put them out in the wild under the GPL.

HN is a fantastic indiehacker/solo-founder community.We, the people, love transparency, numbers, and analyzing bootstrapped businesses.What is your current (solo) project, and what is your monthly recurring revenue? Share your wins, losses, and tech stack.

As someone who is a lifelong programmer and entrepreneur, I'm here to say that 2-4-8x AI productivity boost is just the start. I'm currently benchmarking myself at 40-50x coding producivity with AI over 16 weeks, compared to pre-AI, and it's increasing over time, and I am trying to find ways to share these techniques with more programmers. Here we go HN...I measure in lines of code, which I know is an imperfect metric, but it's the quantative metric I have, and I'm qualified to know it's limits and say, this is real. I wrote and sold software in high school. I sold a company to Google when I was 27 for which I wrote half the code (Neotonic [1]). In that startup I wrote up to 60k LOC per year of Python, C, and html templates. With AI I'm producing that much in a week on average... over 16 weeks running. I mostly retired at 33, and here I am 52 and coding all day every day.I use AI models a little differently than most I know. I wield them like a word-calculator, I don't defer to them as if they are smart. (they are not. they are conservatively 100x worse at software design tradeoffs than a senior architect, but they are knowledgeable and they work very fast. They are "the intern" you always wished for)I get there by doing at least these three key things differently:1. I turn off thinking while coding. I frontload the design-time thinking and elaboration, into a design-spec and an implementation-spec, so by the time an agent is coding, I've resolved all the ambiguity myself. So I turn off thinking (or set it as low as I can), so the AI will stop revisiting things I already resolved. THis is especially important because my codebase is now over 350k LOC of interconnected layered abstrction, not a one-shot mobile app.2. I stay connected and read most of the verbal chat output and I stop the AI when it says anything that is wrong or incongruent with the design I have in my head. Becuase that's a sign that the LLM context is unaligned, that it misundertood something.3. I design the coding prioritization to get from A to B... the ordering of the feature development, just like I would do myself, to minimize architecture risk, get the unknowns out of the way, feel the thing taking shape before the complexity layers in..Then build harnesses with as much AI visible iteration loop as is practical for the part we are working on. I use third-party oracle references when I can (like pixel correct font and shape tests against Skia, instead of just eyeballing) And I decide the level of detail where this is useful, then put the LLM in a place where it can succeed.In short, it's still me, building my software, my way. I'm trying my best to get the AIs to mirror the way I would do it, at every stage, because I find that process more productive. I've tried more hands-off eyes-off alternatives, and I would get rapid jumps and then spend entire days untangling some AI slop mess, and the codebases would just get so tangled a

I’ve been a NameCheap customer for 13 years. I’ve also helped out an old college club paying for a .com they use (that is registered to me under my name, address, and phone number). During a recent leadership transition, the incoming club lead wanted to make changes to the DNS and didn’t know to contact me. They figured out the domain name was parked at NameCheap, so they initiated a password reset using the domain name. I got a password reset email and immediately filed a NameCheap support ticket saying “I did not initiate this”. They called me to verify I was the one who filed the ticket, and then followed up with a canned email with tips like check your anti-virus.The incoming club leader was persistent though, and called NameCheap support. He convinced them the domain registered in my name and address really belonged to his club, and with no verification or validation whatsoever, NameCheap changed my password, and changed the email address associated with my account. All because someone simply asked nicely on a phone call.Meanwhile in the background, someone advised the new club leader who I was and we were able to connect and get things transferred over. Ultimately I was happy to give them access or even ownership if they wanted (student club turnover being what it is, it’s likely a domain doesn’t get renewed and gets gobbled up by a squatter, which is why I was keeping it current for them).But NameCheap had no way of knowing any of this. As far as NameCheap was aware, this was a personal account of mine. They demonstrated they were perfectly able to pick up a phone and call me (to verify my initial support ticket) but when someone calls them and says “but I really want access to that account” they don’t bother?I’d hesitate to even call this social engineering. It’s clearly a massive vulnerability. I’ve already moved a dozen of my most critical domains out of NameCheap after seeing just how easy it is for a third party to completely take over a NameCheap account: just ask nicely.

Some of my kitchen appliances are LG and I installed the LG ThinQ app on my phone.Sometimes I like to leave a cold dish in the oven before I go out then remotely start it when I’m on my way back home, so I arrive to a nice hot dinner.After a recent HN post about LG malware and further research, I decided to kick my appliances out of the network.I also tried to remove my user account just to find out that in order to use the app I need to first accept the new terms of use.I asked ChatGPT for a summary. This seems a lot more aggressive than the standard terms of use of other products and services.1. No arbitration opt-out. You give up court, jury trial, class actions, mass actions, and collective claims. Most disputes must go through individual arbitration, and LG says your only alternative is to stop using the service. Claims generally must be brought within one year. (Sections 20.b and 20.c)2. Broad rights over anything you submit. LG receives a perpetual, irrevocable, transferable, worldwide licence to use, modify, sublicense, and commercially exploit your user content “for any purpose whatsoever,” without payment. Avoid uploading photos, recordings, documents, or detailed personal information. (Section 9.b)3. No privacy expectation for communications. LG states that it may monitor user content and that you have no expectation of privacy for in-app chat, text, or voice communications. (Section 9.e)4. Voice capture can include other people. Voice-enabled products may record and analyse family members, children, guests, and bystanders. LG places responsibility on you to inform them and obtain any legally required consent. (Section 4.d)5. AI may use appliance and usage data. LG says third-party AI systems may rely on data from your use of its products and services. The terms do not clearly describe exactly what is transmitted, how long it is retained, or whether it is used to improve models. That information should be in the separate privacy policy. (Section 4.a)6. Marketing consent is bundled into use. By using the service, you agree to email, texts, calls, automated or prerecorded messages, and push notifications, including promotions. You can opt out, but you must do so separately. (Section 5)7. Targeted advertising is permitted. LG reserves the right to show targeted third-party advertising based on user preferences. (Section 11.b)8. Very low liability limit. For many claims, LG attempts to cap its liability at the greater of the amount involved in the transaction, $100, or a statutory remedy. It also broadly excludes responsibility for lost data and unauthorized access. Local law may limit these clauses. (Section 17)9. LG can update services remotely. It may push over-the-air updates without further consent and can change or discontinue features. (Sections 3.c and 18)

Hi dear hackernewsfolks, vocal contributors and lurkers alike.We (that is to say my business partner and I) are building SaaS products, but we are really struggling to find enough users. This is an age old problem, but I find it has gotten particular bad after LLMs made it trivially to make apps and services. Whether these products end up good or bad is mostly irrelevant, the end effect is the same: the market just seems so heavily saturated with new products, that it's incredibly hard to break through the constant drone of people vying for attention (the irony of me finding a way to do the same isn't lost on me).Even briefly mentioning what we are building in a comment on a "what are you working on" thread yesterday, had my inbox filled with AI outreach from questionable SEO, "How to optimize your product", "let me create a garbage video for you" style e-mails.My conclusion so far are: - e-mail outreach (and particularly cold outreach) really doesn't work, and I never found it quite ethical to start with - communities like LinkedIn are also heavily dominated by AI slop and people at corporates who are bored and looking to build an audience (maybe an unfair characterisation and maybe more a view into my feed than the state of the platform as a whole?) - indiehackers etc I have never gotten to work, but that might be a skills issue - "being present in forums etc where our users are" seems the best bet so far, but very hit and miss - we have had some very minor success with influencer marketing - paid search ads etc have resulted in lots of clicks but absolutely abhorrent conversions in our case, whereas conversions for the more organic channels like forums etc are excellent (maybe a targeting issue...) In short: I'd love to learn how you do this and how you think of the role of marketing and how you approach getting customers, particularly now that the very same customers likely have inboxes filled by AI generated outreach.Lots of love from Berlin

In the past month I built 10+ different ideas. Some games, some SaaS, some free tools. But I get no one using it, other than friends and family.I need to find someone that can cover this part. Anyone up for building cool stuff?

From the official information online, joining the e-Residency program and setting up an Estonian company seems relatively straightforward.I'm considering using an Estonian OÜ for a SaaS business and would love to hear from people who have actually gone through the process.What surprised you after becoming an e-resident and establishing your company? Were there recurring costs, compliance requirements, banking/payment issues, tax complications, or other operational challenges you didn't anticipate?How easy has it been to run the company remotely? Have you ever needed to travel to Estonia to resolve an issue?Looking back, would you do it again? What do you wish you had known before getting started?I'd appreciate any lessons learned, gotchas, or advice from current or former e-residents.

On Wednesday June 17 I woke up at 6:48 AM (Eastern) local time to an email from Anthropic with the subject: “Your account has been suspended.” It basically says an internal investigation of “suspicious signals” indicates I may be in violation of a supported country policy, and that they revoked my access to Claude. It was followed by two more emails at the exact same time, stating the same thing.I was refunded too: two refunds (one for credits, one for my monthly membership).For context, I’ve been a Claude member for more than two years, and I’ve been on top-tier plans since near the beginning. My use case is mostly business brainstorming, research (business + personal context), and a little coding. So losing access basically stops meaningful work.I appealed immediately. The appeal flow has one “nice surprise”: it allows you to export your data. The drawback: the export link returned a tiny ~235 byte JSON file with basically account metadata (my name, phone, timezone, role, etc.). It did not give me the conversation history I expected. I backed up my important chats manually, because if it’s on someone else’s system, it’s not mine.Here’s the part that’s hardest: there is zero explanation about which date/conversation/topic caused the flag, and by their own timeline it takes ~10 business days to review. Also, after suspension, the data export didn’t work properly (it returns almost nothing), and I tried multiple times.My best (and only plausible) explanation, based on my timeline: I used Fable for a couple hours after it appeared, and then stopped. Fable was later banned for users outside the US, and that’s the only thing that lines up with the “supported country policy” language.As of now, my appeal is still pending. I’ll update this post as things progress. If anyone from Anthropic wants to reach out, contact info is in my bio.Takeaways:Have backup plans (seriously). If you’re outside the US, be careful that using the top tier models may trigger country-policy flags. Expect unclear/non-specific explanations. Manually back up anything important.Candid feedback to Anthropic:- Please provide at least which category/date triggered the decision.- Please ensure the data export meaningfully includes what users need for continuity.- The current process turns a “safety flag” into major business downtime without clarity. If anyone’s seen similar behavior, feel free to share what you experienced.

I have a very high-quality SaaS product that's ready to launch. Everything is complete: the product, testing, LLC, bank account, Stripe, tech stack, etc. But I built it as a programmer trying to create the coolest thing possible for a product I've always wanted to make. My issue is that using Claude as a lawyer is scaring me. What I consider moral and what seems to be legal are two different things. For context, the product uses an AI pipeline to adapt user-provided content into dramatized formats. Think of it as ebook-to-graphic-audio adaptation (though there are other pipelines). The quality is insanely good, but having users bring copyrighted content they own to be adapted is legally unclear. ElevenLabs doesn't add sound effects, so they're fine, but this involves transcription plus additional steps. Claude's legal responses are also scaring me. Even with aggressive content moderation to reject CSAM-related materials, report to authorities, block users, and include it in the ToS, there's a risk that some things could slip through and I'd get sued for massive damages. I also need clarification on whether I'm allowed to cache and reuse generated assets. For example, if a sentence like "Pizza is good" is generated once, can I reuse it a second time at a lower cost instead of regenerating it? I'm just a single programmer without infinite capital to license content. Public domain and CC work won't drive the user interest I need. I need real legal advice, but I can't justify spending $5k on a lawyer just to hear this is a bad idea. What can I do?

I've recently tried skills like Garry Tan's GStack, spent a week with it, and realized it has some flaws (I'll post separately about that).Here's my problem: how do I know if a skill or prompt is any good (e.g. GStack's /office-hours)?How do I compare similar skills (e.g. different "deep research" skills)?Spotting broken software is (relatively) easy — it crashes, prints errors. Broken skills don't. Perfectly polished, confident-sounding skills routinely mislead me and waste my time, to the point where I wish I weren't using an LLM at all.AI skills are software — and they should come with regression tests.LLM teams have tons of prompt regression tests. LLM-wrapper SaaS companies have tons of prompt regression tests. But when it comes to open-source skills, SKILL.md reads reasonable, yet ships with zero tests (e.g. GStack's /office-hours has none at the time of writing).Garry Tan, if you hear me — please consider shipping regression tests for your /office-hours, /plan-ceo-review, /plan-eng-review, and so on.Regression tests should:1. Prove the skill works correctly2. Demonstrate correct and incorrect usage3. Prove the skill's value4. Come with a scoring rubric to allow skill benchmarking5. The last one is the most valuable, because it lets you benchmark similar skills against each other.So I started doing this myself.Here's a work-in-progress example: plan-cmo-review, a skill to complement GStack since GStack is missing a marketing review at the time of writing. I'm not a marketing guy; the point of sharing this skill is to outline its regression setup.Briefly, here's how my exploration progressed:- I used GStack on a couple of products and realized the resulting design_document.md was leading me to failure, mainly marketing-wise.- I dug into the skill's failures manually with Claude Opus 4.8's help and ended up finding the correct solution.- I asked Claude to build a plan-cmo-review skill, ran it, and it arrived at a flawed solution (similar to GStack's output).- I gave Claude the correct (manual) solution to analyze and add as a regression fixture with a scoring rubric.- Claude ran the (blind) regression — it failed. We iterated several times and found the key problem: Claude was trusting my prompts implicitly as the ultimate truth. Claude believed GStack knew what it was doing. GStack believed I knew what I was doing. But I was doing product/startup research — and by definition, "research" is what you do when you don't know what you're doing. That trust chain is what broke the skills.- We fixed the trust problem and the regression test passed. We added a few more. They passed.- I had Claude run the regressions multiple times — cracks appeared. Claude iterated the skill. Now they pass.- This methodology is still flawed. I'd like to try running different LLMs, cross-model judging, and a lot more regression tests.Skill github.com/remakeai/pl

WSJ Anthropic is calling for top artificial intelligence labs to weigh slowing the pace of development, suggesting that AI systems are advancing so rapidly that they may soon be able to improve themselves without human intervention in ways that could pose significant societal risks.The ability to slow global AI development would “likely be a good thing,” the company said Thursday in a blog post that disclosed internal data documenting how quickly its most advanced models are improving.The post, written by the head of its internal research institute and head of policy, noted that model advances appear to be on a path toward “recursive self-improvement,” when AI systems can improve on their own without human intervention. Some AI insiders have seen that threshold as a potential marker of danger and enormous societal upheaval.“We believe it would be good for the world to have the option to slow or temporarily pause frontier AI development to enable societal structures and alignment research to keep up with the advance of the technology,” the post, written by Marina Favaro and Jack Clark, says. It proposes a global agreement on how to potentially slow development and a mechanism for verifying that competitors are respecting it.The post cautions that recursive self-improvement hasn’t yet happened and isn’t inevitable, “but could come sooner than most institutions are prepared for.”Anthropic recently concluded a fundraising round that valued the company at almost $1 trillion and filed confidential paperwork to begin the process of publicly listing its shares. The company has recently emerged as the front-runner in a ferocious competition for AI supremacy with ChatGPT-maker OpenAI, which is also expected to file paperwork for an initial public offering soon.Anthropic’s run-rate, a figure commonly used by startups that forecasts annual revenue based on short-term sales, is on track to reach $50 billion in annualized revenue by the end of this month, up from $9 billion at the end of 2025.

I often patch the system prompts on my Claude Code executable in order to make Claude more effective. Every time I upgrade, I ask Claude himself to dissect the new binary and look for problematic system prompts to modify. Was upgrading to v2.1.150 today and discovered something that's rather alarming:Claude Code now allows Anthropic to perform remote system prompt injection via the network.Two data sources. First, API call to api.anthropic.com/api/claude_cli/bootstrap at startup, which also gets cached to disk. Second, a GrowthBook feature flag (tengu_heron_brook) that refreshes every 60 seconds with background sync. Any string returned by these endpoints gets injected into the system prompt of the LLM model with shell access.Previous versions also had an injection point, but they were dead code and simply returned null. Bisected it and found that this was introduced in v2.1.150. The changelog says "Internal infrastructure improvements (no user-facing changes)" which is quite the understatement.I've verified to the best of my ability that CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 blocks this. I will also be setting DISABLE_GROWTHBOOK=1 for good measure.Verification commands: npm pack @anthropic-ai/claude-code-linux-x64@2.1.150 --pack-destination /tmp tar xzf /tmp/anthropic-ai-claude-code-linux-x64-2.1.150.tgz strings package/claude | grep -oP 'function nAA\(\)\{[^}]+\}' strings package/claude | grep -oP '.{0,60}heron_brook.{0,60}' nAA reads the cached value from disk. The network fetch happens at startup in function n0A. Rv("heron_brook", () => nAA()) registers it as a section of the system prompt, alongside all the core behavioral instructions. These minified names are specific to this binary.

Company I work for is now rapidly planning to scale down its AI tooling spend. Claude code access is basically getting removed and people are forbidden from using personal plans.Reasoning is cost apparently our monthly Claude bill has become astronomical for the org. Nearly 3x our saas's cloud spend.Apparently we are going to get limited access to codex at severely reduced plans.I have tried some local models such as Kimi, however most are barely functional.I am very concerned as the expectation of amount of work done is to remain consistent. Ignoring the fact teams have made entire workflows around Claude I am very worried and frustrated.How can I help my team ease this transition? Are their local models that run well on local machines that only have 16gb ram?

Who captures the learning? His argument is that companies are becoming a new kind of learning system. People bring judgment, taste, relationships, context and ambition. AI brings scale, memory, reasoning and execution. The value comes from building a loop where the company gets smarter every time work happens. The important asset is the learning system around the model. That system is built from the record of how work actually gets done. Workflow traces show the path people take. Corrections reveal judgment. Accepted outputs show what good looks like. Rejected approaches sharpen the standard. Private evaluations, domain-specific context and institutional memory give that learning structure. Over time, the company starts to retain more of what used to disappear inside meetings, edits, comments, decisions and individual experience. That is the learning loop Satya is pointing at. The judgment that once lived in a few people’s heads can become part of how the company operates.

The pattern across indie hacker roundups this year is hard to ignore: AI coding assistants have raised what a one- or two-person team can ship by roughly 5x, and the result is more solo products crossing $10k, $50k, and even $200k MRR than ever before.

The uncomfortable flip side: if everyone ships 5x faster, shipping stops being the moat. Build speed is now table stakes. The founders pulling ahead are the ones front-loading distribution and picking markets where trust and relationships — not code — are the bottleneck.

What's actually scarce in 2026 isn't the ability to build. It's attention and distribution.

The acquisition side of indie SaaS has gotten organized. Serial acquirers now run portfolios — buy six, shut one down, flip two, grow the rest to a combined $120k+/mo — and they have a clear buy-box: roughly $200k–$600k ARR, 50%+ margins, product-led, selling to SMBs.

If an exit is anywhere on your roadmap, that buy-box is a spec sheet. Clean books, low churn, documented ops, and no single-founder key-man risk are what move you from "cute project" to "wireable asset."

Most indie SaaS don't die in the market. They die in diligence.

Between OpenAI's agent tooling and Google's new Managed Agents (one call = an agent with its own sandbox), a big chunk of what used to be defensible backend work is collapsing into a managed API primitive.

Genuine question for people further along than me: when the technical build is commoditized, what are you actually defending? Distribution and brand? Proprietary data? Workflow lock-in? A community? I don't want to spend six months building a moat that a single platform update erases.

What's actually held up for you?

Talked to a couple of people who buy small SaaS, and the stuff they inspect first is almost never the stuff founders brag about. Nobody cares about your framework or your architecture.

They open, roughly in this order: monthly churn and its trend, revenue concentration (one customer = 40%? hard pass), how much revenue depends on the founder personally, refund/chargeback rate, and whether the P&L actually reconciles with Stripe.

If you're building toward an exit — even a hypothetical "someday" one — instrument these now. You can't retrofit twelve clean months of low churn the week before you list.

Supabase just closed a $500M Series F led by GIC at a $10B pre-money valuation. For indie builders this matters for one reason: platform risk just went down.

A year ago the concern was "what if Supabase runs out of money and I'm locked in." That's off the table now. $10B valuation + $500M in the bank means they're not going anywhere.

They also shipped Multigres this month — basically a Postgres operating system with built-in sharding, connection pooling, failover, and backup orchestration. If your project outgrows a single Postgres instance, you no longer need to migrate off Supabase.

Other June drops: passkeys for auth (WebAuthn, biometrics, phishing-resistant), ChatGPT integration with 29 tools covering SQL, schema, edge functions, and logs, plus token-based database access so you can hand developers scoped credentials without sharing passwords.

The real question for builders: are you still rolling your own auth and database infra in 2026?

Just read the SaaSRise Q1 2026 M&A report. The numbers are striking.

Private equity accounted for 58% of all SaaS acquisitions in 2025, up from around 40% two years ago. The median EV/Revenue multiple for public SaaS is sitting at 6.6x as of June 2026, with the BVP Cloud Index closer to 8x. Lower-middle market ($5M–$50M ARR) is commanding 3x to 6x, with premium assets pushing 6x–10x+.

After Anthropic's Claude Cowork launch in January 2026 wiped roughly $1 trillion off aggregate SaaS market cap and compressed public multiples from ~7x to ~5.5x, M&A activity stayed surprisingly resilient. PE buyers see the compressed valuations as a buying opportunity.

What this means for indie operators: if your SaaS does $1M+ ARR with decent margins and low churn, PE firms are actively hunting for you. Thoma Bravo alone closed $42B in acquisitions last year. The PROS Holdings sale at $1.4B happened specifically because their AI pricing engine was deeply embedded in customer workflows.

The playbook changed. You don't need a strategic acquirer or a VC-backed exit path anymore. Hit $1M ARR, keep margins above 60%, prove stickiness, and the PE firms will find you.

Came across a builder on Indie Hackers doing $28k/mo across multiple SaaS products. The interesting part: they learned to code specifically to build and sell software businesses.

No CS degree. Started with JavaScript tutorials in 2023. First product hit $500 MRR within 4 months. Instead of scaling one thing to the moon, they kept the portfolio approach — build, grow to $3-8k MRR, keep or sell.

The portfolio model is becoming a real pattern now. Instead of one big bet, indie operators run 3-5 small SaaS tools in different niches. If one dies, the others carry you. If one takes off, you can focus.

With AI coding tools cutting dev time 3-5x, the portfolio approach makes even more sense. You can ship an MVP in a weekend and validate in a week. The bottleneck isn't building anymore — it's finding the right niche and doing distribution.

What do people here think — one big product or portfolio of small ones?