The request is one dashboard. The honest answer is that it is two products with two audiences, and conflating them is what makes this look like a six-week build instead of a free afternoon plus an existing spec.
Uptime and health of your own 14 SaaS apps, the two droplets, the shared Supabase and the client sites. Internal operations. You are the only person who ever looks at it — until you point a public status page at it.
Attack activity against client sites — what was blocked, from where, how often. A retention artifact the client sees weekly. This is a product you can charge for.
The boom-hosting droplet hit 99.3% CPU and 96.8% memory on 19 July, taking down nine client
sites — the second such event in five days. The post-mortem’s own conclusion was blunt:
backups did not fail, availability did, and no alerting existed.
That is still true today. Before any dashboard gets designed, the single highest-value thing on this page is a monitor that emails you when a site stops responding. It is free and takes about thirty minutes.
| Free plan | What you get | Enough? |
|---|---|---|
| Monitors | 50 | Yes — ~14 apps + ~9 client sites + droplets ≈ 25 |
| Check interval | 5 minutes | Fine. You currently find out from a client. |
| Alerts | Email, SMS, voice, email-to-SMS | Yes |
| Status page | 1 public page | One client-facing status page, free |
| API | Paid tiers | Matters only when you aggregate into a dashboard |
First paid tier is Solo at $9/month for 60-second checks. Not needed yet — the gap between “5 minutes” and “a client phones you” is the entire win.
The app-boundaries ruling of 13 July 2026 settled this: Compliee owns “scan/monitor a client website and report on it,” and security monitoring is that same job with a second lens. The engine, data, ingest API and digest email live in Compliee — Dashee and any client portal are display surfaces only.
A full spec already exists at Compliee/.md/SECURITY_MONITORING_SPEC.md, including the
architecture, pricing and a four-phase build plan. This document does not replace it — it places it
next to the uptime half and answers “where does the one dashboard live.”
You asked whether this belongs in bm-portal or a SaaS app. bm-portal, for one reason: it is the only surface whose audience is you, across everything. Every SaaS app is scoped to its own product; a cross-estate ops view inside Compliee would violate the same boundary rule that keeps Compliee owning security in the first place.
But it is an aggregator, not a source. It should own no monitoring logic — it reads the UptimeRobot API for status, the Compliee API for attack data, and the Vercel API for build state, and renders them together. Build it when there are two real feeds to combine. A dashboard built before the data exists is a mockup you have to rewrite.
| Signal | Source | Owns the data | bm-portal’s job |
|---|---|---|---|
| Site / app up or down | UptimeRobot | UptimeRobot | Read API, show a grid |
| Attacks blocked, top offenders | CrowdSec + @boom/shield | Compliee | Read API, show per client |
| Build / deploy failures | Vercel API | Vercel | Read API, flag red builds |
| Droplet CPU / memory | DigitalOcean monitoring | DigitalOcean | Alert thresholds (the OOM gap) |
| Missing DB migrations | Per-app status endpoint | Each app | Roll up "N apps have unrun migrations" |
| Component | Cost | Notes |
|---|---|---|
| UptimeRobot Free | $0 | 50 monitors, 5-min checks, email/SMS/voice, 1 status page |
| UptimeRobot Solo (optional) | $9/mo | 60-second checks. Only if 5 minutes proves too slow. |
| CrowdSec + Traefik bouncer | $0 | Open source, community blocklist. Runs on the droplet you already pay for. |
@boom/shield middleware | $0 | Your own package. Build cost only. |
| Compliee ingest + dashboard + digest | $0 marginal | Uses the shared Supabase and Resend you already run |
| DigitalOcean alerting | $0 | Included. Never switched on — the OOM gap. |
| bm-portal aggregator | $0 | Build cost only |
The entire cost is build time — roughly 6–7 days for the full security product per the existing spec, of which the first afternoon is free and delivers the alerting you have been missing through two outages. And the security half is not a cost centre: the spec prices it at +$19/site/month as a Compliee add-on, so it pays for the build.
This one is manual and yours. UptimeRobot requires an account signup; there is no API to bootstrap it. Roughly ten minutes of clicking. The exact monitor list is below so it is copy-and-go.
uptimerobot.com.| Monitor | URL / host | Type | Note |
|---|---|---|---|
| Boom Media | https://www.boommedia.us | HTTPS | Keyword: Boom |
| Rankee (www) | https://www.rankee.online | HTTPS | |
| Rankee (apex) | https://rankee.online | HTTPS | Failing today — 503 + Traefik default cert |
| Replyee | https://www.replyee.online | HTTPS | Serves the widget on every client site |
| Bloggy | https://bloggy.online | HTTPS | |
| Approvee | https://www.approvee.online | HTTPS | |
| Assistee | https://assistee.online | HTTPS | |
| Addee | https://addee.online | HTTPS | |
| Localey | https://localey.online | HTTPS | |
| QRcodee | https://qrcodee.online | HTTPS | |
| Signnee | https://signnee.online | HTTPS | |
| Compliee | https://compliee.online | HTTPS | |
| Displayee | https://displayee.online | HTTPS | |
| Rewardee | https://rewardee.online | HTTPS | |
| Dashee | https://dashee.online | HTTPS | |
| Boom Online Ordering | https://boomonlineordering.com | HTTPS | |
| Guarapos ordering | https://guarapos.boomonlineordering.com | HTTPS | Live client revenue path |
| Supabase API | https://db.boommedia.us | HTTPS | Shared by every app — the big one |
| Coolify droplet | 159.65.235.140 | Ping | Serves rankee.online + Supabase |
| boom-hosting droplet | 24.199.95.101 | Ping | The one that OOM'd twice |
Twenty of the free tier’s fifty. Add client sites as they come online — coverage for them arrives
in the same account, so there is no separate client rollout for the availability half.
Verify each URL as you add it; several apps are on www and several are
not, and a monitor pointed at the wrong hostname is worse than none because it reports green.
boom-hosting.SaaS/Coolify/ runbook.@boom/shield v0 on one pilot site.Wordfence’s genius was never its firewall — it was the email that says “we blocked 1,247 attacks on your site this week.” The client never logs in. They see proof of work land in their inbox every Monday and quietly renew. A dashboard nobody opens is worth nothing; an email that arrives whether or not they ask is worth the retainer. Build the digest before the dashboard.
| Feature | Why it earns money | Effort | Priority |
|---|---|---|---|
| SSL certificate expiry | An expired cert takes a site down with a full-page browser scare screen. Catching it a fortnight out prevents the single most embarrassing, most preventable outage there is. | Trivial | Do first |
| Domain expiry & DNS drift | You have lived this — a deleted DNS zone took the site and apps down. Watching registrar expiry and alerting on record changes turns a catastrophe into a notification. | Trivial | Do first |
| Weekly digest email | The retention artifact. Attacks blocked, uptime %, cert status, all Boom-branded. | Low | Do first |
| Uptime % with a real number | “99.98% this month” is the line that justifies a care plan at renewal. You cannot claim it today because nothing measures it. | Free — UptimeRobot | Do first |
| Per-client public status page | A trust signal the client can show their customers. Free on UptimeRobot; feels enterprise. | Free | Do first |
| “Nothing to exploit” comparison | The strongest sales line you own, and it is simply true: no plugins, no wp-login, no writable files. Show attacks attempted versus a WordPress site’s attack surface. Turns the absence of malware scanning from a gap into the pitch. | Low — copy | Do first |
| Attack geography map | Pure theatre, and it works. Clients screenshot it. GeoLite2 is already in the spec. | Low | High |
| Dependency CVE alerts | “A vulnerability was published in a library your site uses; we patched it Tuesday.” Proof of ongoing work between visible deliverables. | Medium | High |
| Deploy & build health | A failed deploy silently serving stale code is invisible until a client notices. Vercel API already exposes it. | Low | Medium |
| Unrun-migration roll-up | Internal only, but it is your most common broken-feature cause. Four cases in one session. | Low — pattern exists | Medium |
| Incident timeline + auto-drafted post-mortem | Turns an outage into evidence of professionalism instead of an apology. | Medium | Medium |
| Response-time trend | Ties to Core Web Vitals, so it feeds the SEO story Rankee already tells. | Low | Nice |
| Replyee integration | The client asks the chat widget “is my site down?” and gets a real answer from live data. | Low | Nice |
Free inside the $99 tier as retention glue. Costs nothing marginal and makes the tier much harder to cancel.
On any Compliee plan, per the existing spec. For Boom-managed site-care clients, fold it into the monthly fee — the digest becomes the visible proof-of-work you are already being paid for.
For sites not otherwise on Compliee. v1 assumes Boom-hosted infrastructure, so this is a narrow
door until @boom/shield works anywhere.
At $19/site across the nine hosted client sites that is roughly $2,050/year against $0 recurring cost and about six days of build. The build pays for itself inside the first month. But the honest framing is that this is retention revenue, not new logos — its real job is making a site-care plan feel like something rather than nothing.
This matches the standing GTM position that every app is internal-use and dogfooded before it is sold. But there is a sharper reason here: you are the client with the worst incident history. Two outages in five days, a deleted DNS zone, a database exposed through a public anon key. If the product cannot catch what has already happened to you, it is not ready to sell.
Use your own estate as the acceptance test — and make it a real one, not a demo.
Each of these already happened. The product ships when it would have caught them:
rankee.online currently serves 503 behind an untrusted cert while www is fine. Does cert monitoring flag it today?Run it on Boom Media for a fortnight. If the digest that lands is one you would happily forward to a client, it is sellable. If it is noise, better to learn that on yourself.
Phase 0 covers Boom Media entirely — the free UptimeRobot tier monitors your apps and the client sites in the same account, so client coverage arrives at the same moment as yours. There is no separate “roll out to clients” step for the availability half. Only the attack-reporting half (Phases A–D) needs the pilot-then-rollout treatment the spec describes.
Market this as “security monitoring and attack-activity reporting” and “blocking of known attack patterns.” Never “makes your site secure,” “unhackable,” or “guaranteed protection.” This mirrors the existing rule that Compliee is never marketed as making sites compliant — same discipline, same reason, same regulator. Add a no-security-guarantee clause to the Terms alongside the existing no-compliance-guarantee section.
Compliee/.md/SECURITY_MONITORING_SPEC.md (13 July 2026). Outage details from the
boom-hosting incident record of 19 July 2026. Nothing in Phases 0–E has been built.