ZapDM.io Journey to $100k

Why didn't you restore emails via IMAP?

Also, you need a lot of hardening work on the server if you're being hacked so easily.

You also need to run a full RCA on why that happened. Make it a habit to record security incidents and the steps you took to mitigate it.

BlogPro said:

Why didn't you restore emails via IMAP?

Also, you need a lot of hardening work on the server if you're being hacked so easily.

You also need to run a full RCA on why that happened. Make it a habit to record security incidents and the steps you took to mitigate it.

Click to expand...

I did make a backup of the emails, but unfortunately forgot to take a backup of the encryption keys in haste.

Yes, I agree I should have made the server rules very strict. This was my first experience hosting anything outside a traditional hosting services like vercel.

Honestly, I'm still unsure of what exactly happened, I tried to analyse the cause but it's not the codebase that was vulnerable, I think my firewall was disabled and the attacker's botnet found the perfect spot to strike on. I'm going to look deep into this.

Btw, thanks for reading the thread and giving suggestions

Finally found out the main security issue was in the official Next JS framework (CVE-2025-66478), which was allowing the attackers to remotely execute any malicious code. I upgraded to the patched version and all attempts to hack were stopped.

Stats so far:

(+3 new users since last week)

What I did last week (December 22 to December 28):

1. This week I took some time off, did nothing on ZapDM, except doing some RCA for the previous security issues.

What I plan to do this week (December 29 to January 04):

1. Nothing (I really really want to take this week off too )

Costs so far: $847 (+$20 Meta Ads)
Net revenue: $553 ($382 pending, to be confirmed after the 30 day refund period)


PS: Huge thanks to everyone who has supported me so far this year. Your support keeps me motivated, and I’m excited to keep going until we hit the $100k revenue goal. Wishing you a very happy new year in advance!!

Is it a fully self managed server? If you manage it.

Get mod security running and make sure it's up to date.

Also get csf firewall installed and set the deny ip list to 25k to start with (depending on the server spec) and start to play with settings from there.

When you I stall it white list your ip and I suggest you do that everytime you anything via terminal, ftp and so on otherwise you get a temp ban.

You will be shocked how many ssh attempts you get daily and any locations you don't want to market to just do a flat country denial.

...this is exactly why I'm not doing a SaaS, I though there might be some security issues. Still gotta do the law stuff like controlling the refunds situation, etc but at least no endless updates to fix security bugs, especially with all that vibe coding, etc available it might just explode security-wise. That was my biggest fear with a hustle like that so I backed off . Good to see you got this fixed, good luck and I hope your project succeeds .

t2van said:

Is it a fully self managed server? If you manage it.

Get mod security running and make sure it's up to date.

Also get csf firewall installed and set the deny ip list to 25k to start with (depending on the server spec) and start to play with settings from there.

When you I stall it white list your ip and I suggest you do that everytime you anything via terminal, ftp and so on otherwise you get a temp ban.

You will be shocked how many ssh attempts you get daily and any locations you don't want to market to just do a flat country denial.

Click to expand...

Yes, fully managed on my end.
ModSecurity and CSF looks good, I’ll install that. I’ve already added a few tools that automatically blacklists suspicious IPs and handles a bunch of other security checks, so there’s some decent protection in place.

I'm not seeing the SSH attempts anymore, but I don't want to be blocking countries either

Really appreciate the tips, thanks!!

SilverClouds said:

...this is exactly why I'm not doing a SaaS, I though there might be some security issues. Still gotta do the law stuff like controlling the refunds situation, etc but at least no endless updates to fix security bugs, especially with all that vibe coding, etc available it might just explode security-wise. That was my biggest fear with a hustle like that so I backed off . Good to see you got this fixed, good luck and I hope your project succeeds .

Click to expand...

Haha, everything has it's own pros and cons, it’s really about choosing which problems you’re willing to deal with. Maybe big words coming from me but honestly, I’m sure you’re doing great things with your agency as well.

I have been a developer for a long time, (even before studing computer science engineering in college), so I enjoy doing it.

Vibe coding helps a lot (I use it for UI), but as you said, it does surprise you with a lot of bugs, but if you are or have a good developer, you can look into that and fix it.

Thanks for the good wishes!

animesh said:

Yes, fully managed on my end.
ModSecurity and CSF looks good, I’ll install that. I’ve already added a few tools that automatically blacklists suspicious IPs and handles a bunch of other security checks, so there’s some decent protection in place.

I'm not seeing the SSH attempts anymore, but I don't want to be blocking countries either

Really appreciate the tips, thanks!!

Click to expand...

If you running WHM unless you got reporting turned on I can guarantee you, you have SSH attempts going on you just don't know about. When I get into the office laterI I'll screen shot the emails of last weeks attempts... It not even just SSH, people trying to use your mail server (if thats set up) accessing ports you never even thought of closing.. it's wild.

With ModSecurity install the generic OWASP rule set. Take a google into that.

As for the countries, I don't sell to places like North Korea, Afghanistan and so on so we blocked them out right away don't get me wrong they can still and do use a proxy to get around it but it cut out tons of attempts.

Best of luck with it

@animesh



I've not checked server mail since the 23rd!

This is in the few seconds it took me to do the screenshot

t2van said:

If you running WHM unless you got reporting turned on I can guarantee you, you have SSH attempts going on you just don't know about. When I get into the office laterI I'll screen shot the emails of last weeks attempts... It not even just SSH, people trying to use your mail server (if thats set up) accessing ports you never even thought of closing.. it's wild.

With ModSecurity install the generic OWASP rule set. Take a google into that.

As for the countries, I don't sell to places like North Korea, Afghanistan and so on so we blocked them out right away don't get me wrong they can still and do use a proxy to get around it but it cut out tons of attempts.

Best of luck with it

Click to expand...

t2van said:

@animesh

View attachment 4204

I've not checked server mail since the 23rd!

This is in the few seconds it took me to do the screenshot

View attachment 4205

Click to expand...

Wow, this is crazy! These vultures are trying to feed off other people’s hard work… makes me sick
Thanks for sharing this, I am going to implement your recommendations today ASAP.
(Made a little meme to show my appreciation for the info I learned from you )

animesh said:

Wow, this is crazy! These vultures are trying to feed off other people’s hard work… makes me sick
Thanks for sharing this, I am going to implement your recommendations today ASAP.
(Made a little meme to show my appreciation for the info I learned from you )

View attachment 4206​

Click to expand...

Happy to help.

There are better server people than me out there, I've learnt the hardway more often than not sadly!!

That set up I shared there works for us with our own little tweaking.

Once you get CSF set up and installed do some research on reddit and a couple of blog posts some even include known IPs to block as well for both mod security and the firewall.

Best of luck!

Stats so far:

(+14 new users since last week)

What I did last week (December 29 to January 04):

1. Added ModSecurity as suggested by @t2van (Thanks for the suggestions!)
2. Hired someone to do proper social media posting and management
3. Fixed some application bugs

What I plan to do this week (December 29 to January 04):

1. Work on adding a few more features into the app
2. Optimizing for mobile.
3. Create new ad creatives

Got one sale from my Meta Ad campaigns and one from Dealify. I relaxed this week, enjoyed the new year with family at the comfort of my home. Now, I'm going to start working for more time again.

Costs so far: $900 (+$60 Meta Ads)
Net revenue: $616 (+$63, $445 pending so far, to be confirmed after the 30 day refund period)
(I WANT TO INCREASE THE SALES AND BE PROFITABLE, ARGHHH!!)

animesh said:

(I WANT TO INCREASE THE SALES AND BE PROFITABLE, ARGHHH!!)

Click to expand...

Yeah, right? But also, you already have sales, unlike many people that struggle with that. Don't worry, you'll figure it out . I forgot how the structure is like? These are monthly payments? Yearly? Lifetime?

SilverClouds said:

Yeah, right? But also, you already have sales, unlike many people that struggle with that. Don't worry, you'll figure it out . I forgot how the structure is like? These are monthly payments? Yearly? Lifetime?

Click to expand...

Thank you! Hopefully, eventually, I'll figure it out.

These are Lifetime payments coming in. They help with the cash flow for ongoing development and expenses, I'll stop the lifetime plans soon and start focusing on building MRR.

Stats so far:


(+32 new users since last week!!)

What I did last week (January 04 to January 11):

1. Got an awesome social media manager. She is very good at what she does. I'm glad to have her joining the team!
2. Updated ZapAI (core USP) to be very smart. It can now access your products, share beautiful templates and buttons to the user.
3. Reduced the pricing more than 50% to attract more MRR.

What I plan to do this week (January 12 to January 18):

1. Push out 5-6 mini features that I had planned.

Stopping sales for all the LTDs soon, I've sold enough to get the project off the ground, now need to focus on the MRR. Need to get more funds somehow. All my funds are going to exhaust soon.

Costs so far: $900 (+$55 Social Media)
Net revenue: $616 ($324 pending so far, to be confirmed after the 30 day refund period)