Zeabur is closing. Where should you go?

The deploy platform a lot of solo builders and small teams relied on will be switched off by 31 December. Here is how to land somewhere sensible without losing a weekend to panic.

What happened

On 17 October, Zeabur's founder emailed customers to say the company is winding the platform down. The message came three days after a second break-in, and about seven weeks after the first. In late August an attacker used an old-style API key to read the environment variables stored in projects. The October intrusion reached Zeabur's internal systems and some customer services, and the founder said it was wider than the one in August.

He said the team weighed security, the workload of keeping the system running, and what it would take to continue, then chose to stop. He also said growth had hit a ceiling.

If you are someone who pushed code to GitHub and let Zeabur handle the rest, this is irritating, not catastrophic. You have time. Not a lot, but enough if you start this week.

The dates that matter

Dates are from the founder's email to customers, as reported on 17 October.

• From 17 October: no new dedicated servers or domains. Balance refunds are open.
• 1 December: shared clusters pause and dedicated servers stop renewing. Each server shuts down on its own expiry date during December. Paused shared services can be restarted by hand to take backups.
• 31 December: everything is off. Zeabur says this is the final day, not a promise that your service runs until then.
• Still unannounced: when your data is deleted and the last day to export it. Don't wait for those dates.

Domains you bought through Zeabur can already be transferred out by yourself.

Three things to do before you pick a new home

1. Treat your secrets as exposed. The first incident exposed environment variables and the second went deeper, so rotate database passwords, API keys, OAuth secrets and automation tokens (n8n and similar). Do this now, not after you move.
2. Back up everything. Database dumps, storage volumes, uploaded files. Copy your environment variables into a password manager.
3. File your claims. Refunds of account balance and compensation for breach losses are separate requests, both through Zeabur Support. A Taipei consumer-protection official said refunds should come back in the currency you originally paid. Keep your receipts.

Where to go: pick by what you run

There is no single winner. I haven't compared current prices or free tiers, so check each provider's pricing page before you commit. What follows is about fit.

Pick the sign that matches what you actually run.

A web app or API deployed from GitHub

Look at Railway or Render. Both build from your repo, attach databases and handle HTTPS. One benchmark of Zeabur alternatives lists Railway, Render and Vercel as the closest matches. My rule of thumb: Railway has the most Zeabur-like click-and-go feel, and Render is the steadier, more Heroku-like choice.

Mostly a frontend: Next.js, Astro, static sites

Vercel, Netlify and Cloudflare Pages are built for this. One catch: Zeabur ran your app as a persistent server. Serverless hosts run short functions, so background jobs, websockets and anything held in memory may need rework.

You rented a dedicated server and like owning the box

Keep the server idea, drop the platform. A VPS from Hetzner or DigitalOcean plus an open-source, self-hosted deploy tool such as Coolify or Dokploy gives you push-to-deploy with your own keys. The price is that you patch the machine. After this autumn, plenty of people will accept that. If you connected your own VPS to Zeabur, ask your provider what happens to the machine once Zeabur's control layer goes. I couldn't confirm that from the shutdown notice.

A company with compliance needs or users worldwide

Go to a big cloud's container service: Google Cloud Run, AWS App Runner or Azure Container Apps. Setup takes longer, but you get audit trails, invoicing and regions that procurement teams recognise. For a mixed global audience, check three things: a region near your users (Zeabur was popular with Asian audiences), where your data is legally stored, and which currency you are billed in.

An app an AI tool built for you

You don't have to learn infrastructure, but don't redeploy blind. Ask your coding assistant for a step-by-step migration plan for the target host, move a staging copy first, and only then touch the real domain. Hosts with strong documentation make this far easier.

Ask any new host these four questions

This episode is a useful reminder that the company behind your hosting can disappear. Before you sign up anywhere, spend ten minutes on the following.

• Can I export everything? Look for plain database dumps, downloadable volumes and a documented way to pull out your configuration.
• How are secrets stored and rotated? You want scoped, expiring keys, not one old token that opens every door.
• Where do my users sit, and where does the data live? Latency and legal exposure both depend on the answer.
• What happens if you shut down? A clear notice period and a published data-deletion policy are good signs. Silence is not.

None of this guarantees a safe landing. It does tell you how seriously a provider takes the boring parts, and the boring parts are what you are paying for.

How to move without drama

Build the new copy next to the old one. Restore a database dump, run the app on a temporary address, click through everything that matters, then lower your DNS time-to-live a day ahead and switch. Keep the old setup running for a week of clean traffic. Aim to finish by mid-November. 30 December is not a plan, because your shared services pause on the 1st.

Last, choose something you can leave. A Dockerfile in your repo and database dumps you can run yourself turn the next shutdown into an afternoon's work.

The short version