Launch, Payments from Friends, a Hacked Server

By Georg Malahov

It was one of those days that stay with you for a long time. I sat with the project for about seven hours straight: built a three-page onboarding, a demo session, data export and import, finally fixed a maddening bug with tab switching, covered it all with tests, and pushed to prod. One pull request that day deleted five thousand lines and added twenty — a big piece of work, and breathing got easier afterwards. This is exactly the kind of work that comes naturally to me; here I'm in my element. Financially, though, I'm already fairly deep in the red — I tallied up the expenses the other day: the marketing course I'm doing this launch as part of, subscriptions to tools, small services here and there — it comes to about three thousand euros — and that makes me want to open up and get the first sales as soon as possible.

On December 8th the first test payment went through — I ran the charge myself, and it worked. And on the 10th the extension officially went live in the public Chrome Store. That day I wrote down that "today is a great day," and the feeling was real, though there's exactly as much greatness in it as in any day when a long-awaited step finally happens. I got on a call with a friend; he went through the whole install flow start to finish, found a few small UX flaws with the onboarding and the counters — but got through. The first live payments came from friends — a couple of people I'd given it to for testing, who walked the whole path to help. That's nice, but I'm well aware this is a rehearsal so far, not the market.

The store listing promises the main thing: a transcript of your Google Meet call — and no bot participant in the call.

And a week later a dose of reality arrived. On December 17th, while yet another version was being published, it was confirmed: one of my servers had been hacked — judging by the traces, someone had gotten in about ten days earlier and had been quietly mining crypto. The hole wasn't mine: in early December a critical vulnerability was found in React Server Components (CVE-2025-55182, aka React2Shell) — apps built on Next.js, the main framework behind my landing pages, were in the line of fire, and a wave of crypto-miner break-ins rolled across the whole internet back then. The product wasn't harmed — of all its parts, that machine only held the landing page, no secrets — but paranoia kicked in at full strength: recreate the server, rotate passwords and environment variables everywhere I could reach. I lost time on that instead of real work. The lesson is a general one: even if you broke nothing yourself, someone else's hole in a popular framework will reach any machine you didn't update in time.

By the end of the week I did finish a couple of fixes and sent the new version off for review. Took me longer than planned, as usual — an extra three hours instead of a trip to the pool. But it came out well — really good, I'd say. Also, while I was busy with the release, an email arrived from Nigeria offering to fake a thousand installs for me for two hundred and fifty dollars. Obvious junk, but it's funny that I've already grown big enough for people to write me things like that.

The way I frame the extension for myself right now: it's my second project, one I want to turn into a personal source of extra income and use to practice marketing and running a business. Not the main job — a proving ground. So the plan for the holidays is to work not on code but on promotion: wait for the new version to be approved and head into the free channels.

There's one near-term goal: a first payment from someone I don't know and never talked into it. So far every payment has come from friends, and those don't count: friends buy to help, not because they need it, and purchases like that say nothing about the market. If there's even one stranger who found it on their own, installed it on their own, and paid on their own — the product is needed by someone outside my circle. If not — for now it's needed only by me and my friends.

Sending the version off for Chrome Store review — and finally going to bed.