Before opening the door, I asked who was going to walk in

The day before launching ExchangeYourVan, I didn’t ship a single new feature. I spent the whole day running tests and closing out email verification. Somewhere in the middle of that afternoon, I asked myself a question that changed how I think about the product: How do I know the person on the other side is real?

What ExchangeYourVan is — and why security changes everything

ExchangeYourVan isn’t a buy/sell marketplace. It’s an exchange platform: two people agree to swap vans. Nobody pays for the vehicle. Nobody negotiates a price.

That changes what “security” means entirely. On a normal marketplace, if something goes wrong, the risk is usually money — a refund, a dispute. Here the risk is your van, with your keys, in the hands of someone you’ve never met. And you have theirs.

When you think about it that way, the question isn’t “how do I protect the platform?” It’s “how do I protect the people trusting it?”

The real problem: it wasn’t technology, it was trust

We were going live, and “going live” meant one very specific thing: the signup flow had to work without cracks, and creating a fake account couldn’t be trivial.

If someone can register a hundred accounts in five minutes, they can inflate the number of active profiles, impersonate a real van lifer, or try to access other users’ contact information. On a platform where you’re coordinating a physical vehicle handoff with a stranger, that’s not a security bug — it’s the end of the product.

Two fronts, one goal:

The first was functional end-to-end testing of the full flow: user registers → verifies account → lists their van → is ready to search for an exchange. I tested the happy path, but more importantly the error paths: a field that validates wrong, a state that doesn’t save, a session that expires mid-form. On an exchange platform, every user who leaves without completing signup is one fewer potential exchange partner for everyone else.

The second was OTP verification by email. Without it, creating an account costs zero effort — exactly what a bot needs. With it, you add one step: the user gets a six-digit code and enters it. A bot doesn’t check email. A real person does.

The business decision behind the technical one

Adding OTP adds friction. There’s always a percentage of users who drop off at each extra step. I know that.

The decision to include it was a business decision, not a technical one: I’d rather lose the 2% of users who don’t finish registration than risk a real user coordinating an exchange with an account that isn’t even a person.

On a trust-based platform, a fake profile isn’t just bad data in the database. It’s a direct threat to the real user on the other side. And if that threat becomes real — if someone hands over their keys expecting an exchange and the other party doesn’t exist — the platform dies. Not because the technology failed, but because people stop trusting it.

What I learned — and what applies to any platform

Testing and security aren’t “last-minute work before launch.” They are, literally, the product.

At ExchangeYourVan, what we’re selling isn’t a list of vans — it’s the confidence that the person on the other side of the exchange is real and serious. A broken signup flow or a fake account aren’t technical details in this model: they’re the difference between someone trusting us with their vehicle or not.

Testing the happy path isn’t testing. The value is in the error paths: what happens when something breaks in the middle of a process that matters to someone.

If you’re building a platform where your users need to trust other users — a services marketplace, a rental platform, an exchange system — ask yourself this before you launch: What’s at stake for my user if the other person isn’t real? That answer tells you how much friction is worth adding at signup.

---

We just launched ExchangeYourVan, built for real van exchanges between real people. You can see the full project story at juliobuilds.com/projects/exchangeyourvan.