Honest, founder-realistic plan for going from v5 release to first $1k MRR. Written for ShadowHunter89 (non-technical founder, building solo, in Pakistan).
- Week 1: Tag v5.0.0, ship to PyPI, write 1 launch blog post (the AROP case study)
- Week 2: Show HN launch with the case study. Goal: 50 GitHub stars.
- Week 3: Product Hunt launch. Goal: 30 paid customers in 24h ($870-$3,000).
- Week 4: Content engine — write 4 more case studies (one per ecosystem project).
- Months 2-3: Iterate on free→paid funnel. Target: $1k MRR.
- Month 4+: Ship the SaaS dashboard (separate launch). Target: $5-10k MRR.
Realistic first-month revenue: $200-$1,500. Don't bet rent on it.
"shadow-stack adds production infrastructure — auth, billing, monitoring, tests — to your existing Python or Node project in minutes, AI-adapted to your code style. Free to scan, paid to inject."
That's the elevator. Don't elaborate unless asked.
Three concrete personas. Build for these, ignore others:
| # | Persona | What they're searching for | Why they pay |
|---|---|---|---|
| 1 | Indie hacker shipping a SaaS | "fastapi auth boilerplate", "stripe webhook fastapi" | Saves 2-3 days per project. Pays $29/mo to ship faster. |
| 2 | Agency dev building client projects | "production fastapi template", "node express auth jwt" | Reuses across clients, saves 4-6 hours each. $99/mo team plan. |
| 3 | Senior dev auditing legacy codebase | "fastapi security audit", "missing modules in fastapi" | Free scan shows what's missing; pays $29 to fix one project. |
Persona 1 is who you target first. They're cheapest to acquire (HN, r/SaaS, indiehackers.com) and convert fastest.
| Tier | Price | What you get |
|---|---|---|
| Free | $0 | Unlimited scans, audits, diffs, cost estimates |
| Solo | $29/mo | Inject + recipes + upgrade — 1 user |
| Lifetime | $149 one-time | Solo, forever (Product Hunt launch only) |
| Team | $99/mo | 5 seats + Slack notifications |
| Enterprise | $499/mo | Self-hosted, Ollama only, SLA |
The free→paid conversion logic (your insight, already implemented):
- Scan shows score: "🔴 23/100"
- Audit shows fixes: "Stripe webhooks not verified — critical"
- User runs
inject→ gets blocked → "$29/mo unlocks this" - That's the funnel.
Don't build a tier feature wall. Free users get unlimited reads. Only writes (inject/upgrade) require payment. This is what converts.
- Tag
v5.0.0and push to ShadowHunter89/shadow-stack - Publish to PyPI:
python -m build && twine upload dist/* - Buy domain
shadow-stack.dev($12/yr, Cloudflare or Namecheap) - One landing page at shadow-stack.dev (Cloudflare Pages, free hosting)
- Hero: the one-sentence pitch
- Demo: GIF of
shadow-stack scan E:\aropshowing a real score - Pricing: tier table from above
- "Get a license" button → Stripe Payment Link (no website needed)
- "Read the docs" → GitHub README
- Set up Stripe (or Lemon Squeezy, simpler for non-US founders)
- 1 product, 4 prices (Solo monthly, Solo annual, Team monthly, Lifetime one-time)
- Webhook endpoint that calls your
issue_license.pyscript and emails the key - Or manually: customer pays → you get email → you run script → email key
Write a blog post on shadowhunter89.dev (or Medium if no site yet):
"I scanned my own AI proxy project with shadow-stack v5 — here's what it found, and what fixed it"
- Show AROP at 21/100 with 3 critical issues (real data — you have it)
- Show the inject command running
- Show the score after — 80+/100
- Time taken: 8 minutes
- Cost: $0.04 in Claude API calls
This is your single most important asset. It's your demo, your trust signal, and your social proof in one piece. Do not skip this.
Title: "Show HN: shadow-stack v5 — production modules for Python and Node, AI-adapted to your codebase"
Body:
- Link to shadow-stack.dev
- Link to AROP case study
- "Free to scan/audit, paid to inject. Solo $29/mo, Lifetime $149."
- Mention BSL license, framework-aware scanner, Ed25519-signed keys
Best time: 9am Eastern, Tuesday or Wednesday. Reply to every comment within 1 hour.
Realistic outcome: 50-200 visits, 5-15 GitHub stars, 1-3 paying customers ($29-$447 first day).
Use the same case study + product page. Get 5-10 friends to upvote in the first hour.
Realistic outcome: 100-500 visits in 24h, 20-80 GitHub stars, 3-10 paying customers ($87-$1,490).
PH likes "lifetime deals" — emphasize the $149 lifetime tier as a launch special.
Title: "Built a tool that adds production modules to existing Python projects (free scans, paid inject)"
- Post the case study link
- Engage in comments — answer questions, take feature requests
- Indiehackers post: "Open-sourced my SaaS toolkit with paid extensions — first $X in revenue"
- Twitter thread: 8-tweet breakdown of the AROP case study with screenshots
- "I scanned 11 of my projects — here's what I learned about my own code"
- Use the production-audit data we already have
- Link from the GitHub README to all case studies
| Channel | Effort | Expected reach | Conversion |
|---|---|---|---|
| HN front page | High (1 great post) | 5-50k visits | 0.5-2% to free signup |
| Product Hunt | Medium | 1-5k visits | 1-3% to paid |
| Reddit r/Python, r/SaaS | Low (per post) | 200-2k visits | 0.5-1% |
| Twitter/X dev community | Continuous | 100-1k per thread | 0.1-0.5% |
| Dev newsletters (Pycoders, JS Weekly) | High (need to pitch) | 30k-100k | 1-2% |
| YouTube demo videos | Very high (need on camera) | Slow accrual | High when it lands |
| SEO blog posts | Continuous | 6-month payback | 1-3% |
The order matters. Start with HN (one big spike). Use the spike traffic to build email list. Then PH. Then everything else builds on the foundation.
When you post anywhere, lead with this story — not the features:
"I had 11 unfinished projects, all needing the same boring infrastructure (auth, monitoring, tests, payments). Spent 6 months copy-pasting boilerplate between them. Built shadow-stack to inject this stuff once, AI-adapted to each project's existing code style. Now my AROP project went from 21/100 to 80/100 in 8 minutes. Open-sourcing the tool, charging for the inject."
This works because:
- It's true (you really do have 11 projects)
- It's relatable (every developer has the boilerplate problem)
- It positions you as a builder, not a marketer
- It justifies the BSL + paid inject model
For "news" coverage, send a personal email to specific outlets:
| Outlet | Pitch angle |
|---|---|
| TechCrunch (long shot) | "Pakistani student bootstraps developer tool to $X MRR in N months" |
| The Register | "BSL-licensed dev tool challenges Cookiecutter / ShipFast" |
| The New Stack | "How AI-adaptive code injection works under the hood" |
| Dev.to / Hashnode (you write these) | The case study, posted to your own profile |
| Pycoders Weekly (newsletter) | Email rsvp@pycoders.com with one paragraph + link |
| Console.dev | They feature dev tools. Apply at console.dev/submit |
Don't pay for press. Sponsored posts in dev media are ignored. Earned coverage from a great launch is what works.
These are the only assets you need to ship the v5 launch. Don't overbuild.
| Asset | Where it lives | Effort |
|---|---|---|
| Landing page (4 sections) | shadow-stack.dev (Cloudflare Pages) | 3 hours |
| Demo GIF (60 seconds) | embedded in landing + README | 1 hour with LICEcap |
| Pricing page | section of landing | included above |
| AROP case study | shadowhunter89.dev/blog or dev.to | 4 hours |
| README on GitHub | already done in v5 | done |
| 5 social media graphics | Canva (free) | 2 hours |
| Product Hunt assets (logo, gallery, tagline) | producthunt.com/posts/new | 2 hours |
Total: 12-15 hours of work. Block one weekend.
Pakistan banking is restricted. Don't try to use Stripe directly with a Pakistan bank — it will fail compliance. Use one of:
| Option | Pros | Cons |
|---|---|---|
| Lemon Squeezy | Merchant of record (handles tax + fraud), pays via Wise/Payoneer | 5% + $0.50 fee |
| Paddle | Same as Lemon Squeezy, larger company | 5% fee |
| Polar.sh | Built for open-source devs, Stripe Connect under the hood | 4% + $0.40 fee |
| Gumroad | Simplest setup, Pakistani sellers supported | 10% fee but easiest |
Recommendation: Lemon Squeezy. They handle international tax (you don't), they pay out to Wise (Pakistan-friendly), and the API integrates cleanly. Setup: 30 minutes.
- Customer pays via Lemon Squeezy
- Lemon Squeezy sends webhook to a small endpoint (Vercel free tier — add a serverless function)
- Endpoint runs
scripts/issue_license.py solo <customer_email> 365 - Endpoint emails the key to the customer
- Done
For v5 launch, manual issuance is fine — you'll get 1-30 customers/month. Email each one. Move to automated when volume justifies it.
Honest expectations — not the kind a VC pitch deck would show:
| Period | Best case | Most likely | Worst case |
|---|---|---|---|
| Day 1 (HN launch) | $500 | $87 | $0 |
| Week 1 | $2,000 | $300 | $0 |
| Month 1 | $5,000 | $700 | $200 |
| Month 3 | $15,000 cumulative | $2,500 cumulative | $400 cumulative |
| Month 6 | $50k cumulative + $5k MRR | $8k cumulative + $1k MRR | $1k cumulative + $0 MRR |
The "most likely" column is what to plan around. The launch will go OK, not viral. Most paid customers will come from word-of-mouth months 2-6, not from the launch spike. Build a content engine and keep shipping.
- ❌ Don't run paid ads. Cost-per-click for "fastapi" / "saas boilerplate" is $5+. You can't beat your own organic content.
- ❌ Don't build a Discord community on day 1. Wait until you have 100+ paid users.
- ❌ Don't add features users haven't asked for. Ship v5, then listen for 60 days before v5.1.
- ❌ Don't go international on day 1. English-speaking dev community first.
- ❌ Don't quit university for this. Keep optionality.
| Risk | Likelihood | Mitigation |
|---|---|---|
| HN doesn't bite | Medium | PH backup; case studies are the durable asset |
| 0 paid customers in month 1 | High | Plan for $0 MRR; treat free signups as the win |
| Someone forks + sells (BSL violation) | Low | BSL has legal teeth; you can DMCA them |
| Pakistan payment processing breaks | Medium | Use Lemon Squeezy, not direct Stripe |
| Scope creep eats next 6 months | High | This doc — refer back to it |
| You burn out | High | Set 10h/week cap. This is a side project until $5k MRR. |
After Day 30:
- If MRR > $500/mo: Keep iterating, ship the SaaS dashboard plan from earlier
- If MRR is $100-500/mo: Double down on content, add 5 more case studies
- If MRR is $0-100/mo: Don't quit, but cap effort at 5h/week and focus on AI Services agency revenue (which we already established as your fastest path)
"Would I, as a developer with my real problem and my real wallet, pay $29/mo for this?"
If the answer is no — you have the wrong product, not the wrong marketing. For shadow-stack v5, the answer is yes for indie hackers shipping FastAPI SaaS products. That's the beachhead. Don't drift.
Now go ship it. This document is reference, not religion. Update it monthly with what's working.