After bootstrapping to $5k MRR, we decided it was time to bring in an expert to scale our user acquisition. We hired a highly recommended "Growth Marketer" who promised to "10x our pipeline" using paid ads and a revamped funnel. We agreed to a retainer of $6,000/month (plus ad spend), which was a massive chunk of our runway.
For the first month, they were incredibly active. They set up HubSpot, redesigned our landing page, and launched campaigns on LinkedIn and Google. It looked like they were doing a lot of work.
But at the end of month two, I pulled the data:
We had spent $10,000 in ad spend (on top of their $12,000 retainer).
We generated 15,000 clicks, but our bounce rate was 92%.
We got 45 new free signups, but only 1 paying customer (a $49/month plan).
We spent six months in beta testing our B2B SaaS platform, and last Tuesday, we finally launched out of beta with a massive marketing push. We were thrilled. By Thursday morning, we had onboarded 50 paying customers on our $99/month plan.
On Thursday afternoon, I was doing a routine review of our database logs and my heart stopped. I noticed that a change we made to our API authentication right before launch had accidentally bypassed our multi-tenant architecture. Essentially, if a user knew exactly how to format an API request, they could pull data from other companies' dashboards.
I felt sick to my stomach. This was a catastrophic privacy breach.
We immediately took the entire platform offline to patch the hole. For 6 hours, our site displayed a "Scheduled Maintenance" page while I sat in a cold sweat fixing the logic. We patched it, brought it back online, and then I had to do the hardest thing I've ever done as a founder: write an email to those 50 customers confessing the mistake.
