On October 17, Zeabur founder Yuanlin Lin sent a letter to every user. It began: "Today, we have a difficult decision to share with all of you." The sentence that followed is one many people probably read more than once: Zeabur will gradually wind down the platform. Some services will stop in stages starting December 1, and all dedicated servers and shared clusters will be shut down by December 31.
The night we read that letter, we talked it over at length and thought about it for a long time.
What Zeabur does is a lot like what we do: it takes services like n8n, OpenClaw and WordPress, which are great to use but hard to set up, and packages them so that people who don't want to touch a server can simply use them. We're both Taiwanese teams doing very similar work, and Zeabur has always been a company we looked up to and deeply respected. We've quietly followed them all along. Whenever a new template launched, the interface got a little smoother, or someone in the community shared something they'd built on Zeabur, we would stop and take a look, and we often measured ourselves against them.
When Zeabur raised a US$2 million seed round led by Silicon Valley VC 500 Global, several people on our team were talking about it, and we'd be lying if we said we weren't envious. A Taiwanese cloud team being noticed by Silicon Valley and landing real funding to compete internationally was exciting news for our whole community.
That's why it is genuinely painful to see it come to an end like this. In late August and again in mid-October this year, Zeabur was breached twice. The founder was candid in his letter: "Having another security incident in such a short time has let down the trust you placed in us." Even as they made the decision to stop, they chose to tell every user as early as possible, leave time to move, prepare migration guides, and accept compensation claims and refunds. If we were in their shoes, we're not sure we could have handled it so responsibly. We truly admire that courage.
This post sets out to do two things. First, lay out clearly what happened, for those of you still on Zeabur and wondering what to do next. Second, be honest about who is a good fit for RoamerHost and who isn't, and explain how we protect every service hosted here.
Zeabur's timeline and incident details in this post are compiled from Zeabur's official announcements, status page and incident reports (as of October 17, 2026). For any later updates, please refer to Zeabur's official sources.
What happened at Zeabur
According to the official incident report, the first intrusion took place on August 27. The attacker exploited a vulnerability in a public-facing service that one user had deployed on the platform, gained execution privileges inside that user's environment, then crossed several layers of system boundaries all the way to the production database. There, they read account information along with settings stored in project environment variables, such as third-party API keys and database passwords. As a result, some users' AI service keys were stolen and misused.
The second incident happened on October 14 and had a wider impact than the one in August. Beyond the shared clusters, some dedicated servers were also accessed without authorization, and the leaked data included service environment variables, account information and API tokens. As of publication, the full cause of the second incident is still under investigation. Three days later, Zeabur announced it would shut down.
| Date (2026) | What happened |
|---|---|
| August 27 | First security incident: parts of the production database were read, including keys and passwords stored in environment variables |
| October 14 | Second security incident, extending to some dedicated servers and the platform database |
| October 17 | Announced a gradual shutdown, stopped new purchases of dedicated servers and domains, and began accepting refunds of account balances |
| From December 1 | Dedicated servers can no longer be renewed and shut down as each one expires; all shared-cluster services are suspended (they can be resumed manually to back up data) |
| December 31 | All dedicated servers expire and shut down, and shared clusters stop service |
We're not here to judge who was right or wrong. Anyone who works in cloud knows there is no such thing as 100% security, and what happened to them today could happen to any platform tomorrow. Still, a few points raised in the official report are a very real reminder for every platform: a vulnerability in one user's service should never open a path all the way to the platform's core; keys stored on a platform need a defined scope and must be revocable; and when something really does go wrong, the platform should be the first to know, instead of going back to investigate only after users notice something is off with their bills.
The weekend after reading the report, we went through our own systems again from top to bottom, walked that same path from an attacker's point of view, and closed every gap we found, one by one. We explain what we did further down.
Still on Zeabur? Here's what you can do right now
Wherever you end up moving, we recommend doing the following first. The sooner, the better.
- Check when your services will shut down. Dedicated servers shut down on their own expiry dates, while shared clusters are suspended as early as December 1. December 31 is when everything stops, but your services may not last until then.
- Back up your data first. Zeabur hasn't yet announced the data deletion date or the final export deadline, so don't wait for that announcement to start preparing.
- Replace every key you ever stored in Zeabur environment variables. AI service API keys, database passwords, third-party service tokens: if they're still valid, we recommend generating new ones. This is also Zeabur's official recommendation.
- Transfer out any domains you bought through Zeabur. Self-service transfers are already open, so you can fold this into your migration plan.
- Apply for refunds and compensation separately. Account balance refunds and compensation for losses from the security incidents are two separate things. Both are handled by Zeabur Support, so when you contact them, say which one you're applying for.
Who is a good fit for RoamerHost
If you're looking for a Zeabur alternative, start by being clear about what you run on Zeabur, because different services call for different new homes.
First, our philosophy. From day one, RoamerHost decided to offer only "mature services": open-source software like WordPress, n8n, OpenClaw and Hermes Agent that has been proven by a large number of users and keeps receiving official updates, with installation, updates, backups and monitoring all handled by us. You don't need to know how to configure a server. Just open your browser and start using it.
On the other hand, we don't offer a way to upload and run code you wrote yourself, or projects written with AI (what people often call vibe coding). That's a deliberate choice. Every program a user uploads that the platform doesn't recognize is one more door we can't see clearly; and on shared infrastructure, if even one of those doors isn't properly closed, the damage often isn't limited to that one user. We'd rather have fewer doors, as long as every one of them is a door we know well and can keep secure.
| What you use on Zeabur | On RoamerHost |
|---|---|
| n8n automation workflows | A ready-made managed n8n plan. You can import your workflows, and both Code nodes and community nodes work |
| OpenClaw AI assistant | A ready-made OpenClaw plan: a personal secretary that proactively reminds you of your schedule and to-dos. We can help move your settings and skills over |
| WordPress sites | WP × Roamer AI. Once your site has moved over, just tell the AI when you want to change content or fix a problem |
| Hermes Agent | A ready-made plan: an AI assistant that gets to know you better the more you use it |
| Your own frontend or backend code, standalone databases | Not offered at this time. We recommend a cloud host where you can deploy your own code |
RoamerHost should be a great fit if this sounds like you: you run n8n, OpenClaw or WordPress on Zeabur; you don't want to manage servers yourself and would like someone else to take care of updates, backups and whatever goes wrong in the middle of the night; and when you run into a problem, you want to reach someone who speaks Chinese and understands what you're talking about.
On the flip side, if you need to deploy applications you've built yourself, choose your own Docker images, or rent a standalone PostgreSQL or Redis as a service, we can't help with that right now, and we don't want to say yes just to keep you. Those needs are better served by a cloud host or VPS where you can deploy code freely.
How we protect the services hosted here
To be clear up front: this section covers architecture and principles. It won't say where our servers are or what specs they run, and it won't go into detailed technical configuration. The reason is simple: those details wouldn't help you, but they would be very useful to anyone looking for weaknesses.
Only mature services make it onto the platform
As mentioned above, we don't let users upload their own code to run. Every type of service on the platform is open-source software that we know well, maintain over the long term, and keep updated with official releases. Fewer kinds of doors, and we know how to lock every one of them: that's the first layer of our entire security design.
Every member gets an isolated environment, out of everyone else's reach
Each member's services run in their own isolated environment, with separate files, database accounts and cache space. Internal networks are isolated between WordPress sites and between n8n instances, too. Even if a site one day installs a vulnerable plugin and gets compromised, the attacker stays trapped inside that one environment, unable to see the neighboring member's data or reach the neighboring member's services.
The platform core sits at the very center
The platform core, including member data, billing and the AI gateway, is open only to the platform itself; member services have no way to reach it from the inside. In Zeabur's first incident, the attacker made their way from one user's service all the way to the production database. Here, that path is blocked at the very first step. We've also simulated an attacker sitting inside a member environment, tried one by one what could be reached from there, and confirmed that each of these walls really is closed.
Google-only sign-in, plus phone verification for admins
Attacks that use AI to guess passwords automatically, or that try leaked passwords at scale, are becoming more and more common. So starting October 17, new RoamerHost sign-ups accept Google sign-in only, and after October 31 all accounts will switch to Google sign-in. Google guards your account for you, and you no longer have to remember yet another password. Admin accounts, which can see all member data, must also enter a verification code from a phone on top of signing in with Google, and they never "remember" a sign-in, so even if someone steals the saved sign-in data from a computer, they still can't get into the admin panel.
When something goes wrong, we want to know before you do
One line about Zeabur's first incident stayed with us: monitoring at the time didn't detect the intrusion, and it was only confirmed the next day, when users reported that their API keys had been misused. We don't want our users to be the first to find out. Our servers are now monitored around the clock: sign-ins from unfamiliar locations, changes to system settings, unrecognized programs, sudden spikes in resource usage, and unusual activity on admin accounts all trigger alerts within minutes.
Backups are encrypted and stored somewhere else
Every service is backed up automatically. Backups are encrypted before they leave the server and stored in a separate location, so even if someone got hold of a backup file, they couldn't open it. We also keep watch over the backups themselves: if anyone tries to quietly delete them, we're notified right away, and the backup files can still be recovered.
AI can only touch what's yours
Roamer AI, RoamerHost's AI assistant, can edit your website and adjust your n8n workflows, but it can only work on the signed-in user's own services, never anyone else's. It automatically takes a snapshot before changing a site, asks you to confirm important actions first, and lets you roll back anytime if something breaks. For details, see Is AI Safe on Your Site? Snapshots, Confirmations and Undo.
One last honest note: no platform can guarantee that nothing will ever go wrong, and that includes us. What we can do is make sure every door has someone watching it, so that if one door is opened, there are still several more behind it; and if something really does happen, we know right away and your data can be recovered. We'll keep doing this work, and we'll keep checking and improving.
How the move works
The first step is letting us know which services you use on Zeabur and when each one expires. We'll start by confirming whether they can be moved and which data needs to come over, then plan every step before Zeabur shuts down.
Once your new environment is ready, we bring your data over: n8n workflows and credentials, WordPress site files and databases, and OpenClaw settings and skills. There's one thing you absolutely must do during the move: replace the keys you used on Zeabur with new ones instead of reusing them. The old keys may already have leaked, and switching to a new set is like putting new locks on your new home.
Finally, we test together: run each workflow once, submit each form once, receive each notification once, and switch your domain only after everything checks out. There's no rush to shut down the old services. Let your new home run smoothly for a few days, and once you're sure everything is working, there's still plenty of time to turn the old ones off.
FAQ
Q: When will Zeabur stop working?
According to Zeabur's official announcement, dedicated servers stop accepting renewals from December 1, 2026 and shut down one by one between December 1 and 31 based on each server's expiry date. Shared clusters pause all services from December 1, and you can resume them manually to back up your data. Every service stops on December 31. Zeabur has not yet announced when data will be deleted or the final export deadline.
Q: What are the alternatives to Zeabur?
It depends on what you run on Zeabur. If it's a mature open-source service such as n8n, OpenClaw or WordPress, and you want someone else to manage it instead of looking after servers yourself, a managed platform like RoamerHost is a good fit. If it's your own code, or you need to pick your own Docker images or rent a standalone database, a cloud platform or VPS where you can deploy anything is a better choice.
Q: Can I move my n8n from Zeabur to RoamerHost?
Yes. Export your workflows from n8n on Zeabur and import them into n8n on RoamerHost. We recommend re-creating your credentials during the move and switching to new keys. Code nodes and community nodes both work, and our consultants can help you plan the move.
Q: Can I move my OpenClaw from Zeabur to RoamerHost?
Yes. RoamerHost has ready-made OpenClaw plans, and we can help move your settings and skills. Replace the AI service keys you used on Zeabur with new ones before connecting them again.
Q: Do I need to replace the API keys stored in Zeabur environment variables?
Yes. Zeabur itself recommends regenerating every key and password that was ever stored in a Zeabur environment variable and is still valid, including AI service API keys, database passwords and third-party tokens. Don't carry the old ones over when you move.
Q: Can I deploy my own code on RoamerHost?
Not at the moment. RoamerHost only offers mature services such as WordPress, n8n, OpenClaw and Hermes Agent, and does not let you upload your own code or vibe-coded projects to run. This is a deliberate choice so we can keep every door well guarded.
Q: Do I have to do the move from Zeabur myself?
Not all of it. Tell our consultants which services you use on Zeabur and when they expire. We'll plan the timeline with you, set up the new environment, help move and test your data, and only shut down your Zeabur services once everything is confirmed to work.
If you use n8n, OpenClaw or WordPress on Zeabur
You're welcome to move them here and let us manage them for you. There's still enough time before December 31, but the earlier you start, the more calmly you can move and test. Tell our consultants about your current setup, including which services you use, roughly how much data you have, and when things expire, and we'll plan the move together with you.
We'd also like to say to Zeabur, a company we have always looked up to: thank you for all your hard work. Thank you for everything you've done for developers in Taiwan over the years, and for still choosing to put your users first, even at the hardest moment.
If you have special requirements, you're welcome to reach out and talk with us, too, and we'll see how we can help.
Tell us which services you use on Zeabur and when they expire, and a consultant will get back to you with a plan for the move
References
- Zeabur: August 2026 security incident report, October security incident status page, US$2 million seed round announcement
- Letter from Zeabur founder Yuanlin Lin to users (October 17, 2026)
