51 Days: From One Old Key to Shutdown"

A deployment platform popular with small teams told its users it will shut down by December 31. Here is what happened, and what to do.

Dates from Zeabur's announcement as reported by INSIDE and other outlets.

Some shutdown stories are about a product nobody wanted. This one is about a product people did want. Zeabur grew quickly, then had two serious security incidents in under seven weeks. If you deploy apps for a living, or you simply rely on a few online tools to get your work done, the lessons travel well. I have tied the facts to what the company and the press have reported, and I have marked the opinions as mine.

What happened

On Saturday, October 17, Zeabur's founder, Yuanlin Lin, emailed users to say the platform will wind down. Dedicated servers stop renewing on December 1 and close on their own expiry dates that month. Shared clusters pause the same day, though you can restart a service by hand to take a backup. Everything is meant to be off by December 31.

New dedicated server and domain purchases are already closed. Domains bought through Zeabur can be transferred out now. Balance refunds and compensation for security losses are two separate requests, both handled by Zeabur Support. The final data deletion date and export deadline have not been announced yet.

If you have never used it: Zeabur is a cloud platform that takes your code and runs it for you. It was popular with solo developers and small teams, including people building with AI coding tools. That convenience is the heart of this story.

Two breaches in seven weeks

The first came on August 27. According to Zeabur's incident report, an attacker used an old-style API key to read project environment variables. Those variables included third-party API keys and database passwords. The company confirmed the incident on August 28 and shut down AI Hub, its model-access service, as a defensive step.

The second came on October 14 (UTC) and was wider. Zeabur's status page, as summarised by the Taiwanese outlet INSIDE, says some dedicated servers running on Google Cloud were accessed without permission, and the attacker gained read access to the platform database. Environment variables, account details, API tokens and zSend keys were affected. Three days later, the shutdown email went out.

The reason the founder gives

Lin's email says Zeabur is about three and a half years old, and that the past year was its fastest growth and also the time when deep problems showed up. The system began as a fast-built project. To keep up with the market, the team kept changing architecture and direction, and the complexity and upkeep cost kept climbing. The two incidents, he wrote, made clear that security and operations still had problems the team had to face. After weighing safety, workload and the investment needed to continue, they decided to stop.

Two cautions. This is the founder's own account, and at the time of one report the official blog and status page had not yet carried the announcement. The investigation is also still open, with a fuller incident report promised. So I will not guess at finances or anything else the email does not say. What the facts support is simpler: growth ran ahead of the foundations.

Six lessons for people who build on platforms

These are my reading of the events, not claims from Zeabur.

Fast growth on a prototype is a loan

Every shortcut in a first version is borrowed against the future, and growth is when the bill arrives. A quick project stretched to fit a booming market will sound familiar to anyone who has watched a side project become a product. If you run a team, schedule the unglamorous work, such as access controls, key rotation and monitoring, before you need it.

Old credentials do not retire themselves

The August breach started with a legacy API key. Every system collects old doors: keys nobody remembers issuing, tokens from a migration two years ago. Keep an inventory, give keys an expiry date, and switch off the old path the day you add the new one.

Environment variables become a vault, so treat them like one

A platform dashboard ends up holding your database password, payment key and AI model key in one place. If the platform is breached, they can all go at once. Use narrow permissions, a separate key for each environment, spending limits where the provider offers them, and a rotation routine you have actually practised.

Why secrets stored in one dashboard need narrow scope and regular rotation.

Platform risk is business risk

Convenient platforms feel like infrastructure, but they are companies, and companies can stop. Keep your code in your own repository, your backups somewhere you control, and your domain at a registrar you chose separately. Zeabur customers who bought domains through the platform now have to transfer them out, with a calendar attached. A restore you have tested is worth more than a backup you have only made.

Know where your vendor lives

Zeabur is registered in the United States with no Taiwan branch, so for customers in Taiwan a refund is a cross-border dispute. A Taipei consumer protection officer said refunds should in principle go back in the currency originally paid. Taiwan's cross-border complaint site, eConsumer.gov, and a conversation with your card issuer about disputed charges are the fallback routes if support does not resolve things. Wherever you are, check where a vendor is incorporated before you depend on it.

Speed tools move risk, they do not remove it

AI coding tools let one person ship a working app in a weekend. The deploy, secrets and backup side of that app still needs a careful adult. If an AI wrote your code, you still own the keys, the data and the exit plan.

If you own these, a vendor closing is an inconvenience, not an emergency.

What to do this week

Back up first. Services close on their own expiry dates, so December 31 is the last day, not your deadline.
Rotate every secret stored on Zeabur, including ones you were not told about.
Move your domains out while self-service transfer is open.
File refund and loss claims separately through Zeabur Support, and keep invoices and screenshots.
Choose the new home and run a full restore there before you cut over.

A fair word for the team

It is easy to pile on. Reading the founder's email, what stands out is that he apologised first, gave dates, and opened refunds and domain transfers on day one. Users still carry the cost: migration work, rotated keys and a long weekend. That cost lands hardest on small teams with nobody whose job is infrastructure, which is exactly the crowd a platform like this attracts. A closing notice is also a reminder that trust in a vendor is earned in the boring months, long before anything goes wrong. The most useful response is to treat this as a free rehearsal for the day any vendor of yours disappears, and to make sure that when it happens, you can be gone in an afternoon.

Sources