Latest / The Founder's Journey with Fexingo: First-Time Entrepreneurs, Failures, and Lessons Learned / How a Founder Used Transparency to Turn Crisis
Transcript
- Lucas: There's a moment every startup founder dreads. The one where you get an email that starts with 'We've identified a critical security vulnerability in your platform,' and it's already been shared in a public forum. Luna: Oh, that gut-drop feeling. I've heard founders describe it as watching your entire business flash before your eyes. Lucas: Right. And most founders' instincts go straight to damage control. Cliche as it sounds, get the lawyers on the phone, draft a carefully worded statement that says as little as possible, and pray it blows over. Luna: Which, I mean, is understandable. But there's a counterintuitive play that some founders have tried, and it's the opposite of that. Lucas: Radical transparency. Today I want to talk about a first-time B2B SaaS founder — we'll call her Sarah, not her real name — who faced exactly that situation last year. Her product was a project management tool for mid-sized teams, about 500 customers, maybe two million in annual recurring revenue. Luna: So small enough that one bad PR hit could sink them. Lucas: Exactly. A security researcher found a vulnerability that could let an attacker read other users' data. Not catastrophic in theory, but the kind of thing that would terrify any enterprise buyer. Sarah's co-founder wanted to quietly patch it and say nothing. But Sarah had been reading about this idea of 'radical transparency' in business — companies like Buffer publishing their salaries and revenue publicly. Luna: Right, Buffer's done that for years. But they're a consumer brand. For a B2B company with enterprise clients, that seems risky. Lucas: That's what her co-founder said. But Sarah argued that trust was their biggest asset. If they tried to hide it and it came out later, they'd lose everything. So she made a call: they would write a full public postmortem. Not just 'we fixed a bug,' but the exact timeline, the root cause, how they found it, how they fixed it, and what they were doing to prevent it from happening again. Luna: Wow. Including the vulnerability details? That's... brave. Lucas: They redacted the specific exploit code. But they published the technical description, the date ranges affected, and the fact that no customer data had actually been accessed — which they confirmed through logs. They posted it on their blog, shared it on Hacker News, and emailed every single customer a link to the post. Luna: And the reaction? Lucas: The Hacker News thread was brutal for about six hours. People called them naive, said they'd disclosed too much. But then the tone shifted. Security experts started defending them, saying this was how responsible disclosure should work. Customers started replying to the email saying, 'Thank you for being honest.' Within a week, their net promoter score actually went up. Luna: Wait, their churn? I'd expect a spike. Lucas: Churn dropped by 40% that quarter. Here's the part that blew my mind: they landed two new enterprise contracts during that period. Both prospects told Sarah directly that her transparency was the reason they signed. They said, 'If you're this honest about your mistakes, we trust you with our data.' Luna: That's a powerful signal. It's almost like the vulnerability itself became a selling point. Lucas: Exactly. And there's a psychological mechanism at play here. When you admit a flaw, you signal that you're aware of your weaknesses and you're actively managing them. That's more credible than claiming you have no weaknesses at all. Luna: It's the pratfall effect, isn't it? The idea that a competent person becomes more likable after making a small mistake. Lucas: That's exactly what I was going to say. In social psychology, it's been studied for decades. But in business, we're so conditioned to project invulnerability that we forget the pratfall effect applies to companies too. Luna: Though I imagine there's a line. You can't just announce every mistake. There's a difference between transparency and oversharing. Lucas: Right, and that's the key nuance. Sarah's postmortem worked because it had three specific qualities. First, it was actionable — she didn't just say 'we messed up,' she explained exactly what they were doing to fix it. Second, it was timely — they published within 48 hours of the patch. Third, it was voluntary — they weren't forced to disclose by a regulator or a journalist. That voluntary element is crucial. Luna: So the lesson isn't 'always be transparent,' it's 'when you choose to be transparent, do it fully and quickly.' Lucas: Exactly. And I think there's a deeper point for first-time founders especially. When you're small, you have nothing to lose by being honest. Your reputation is still being built. Sarah told me that after that incident, she started doing 'transparency reports' every quarter — sharing revenue, churn, even the salaries of the first five employees. Luna: And that attracted talent too, I bet. People want to work somewhere that feels honest. Lucas: She said it made hiring easier because candidates already knew the numbers. They knew what they were walking into. No surprises. Luna: It's interesting — this ties into something I've been thinking about with the show. These conversations have genuinely shifted how I think about my own work. It's made me wonder if there are small ways we can be more transparent too. Lucas: That's actually a nice segue. You know, the only reason we can keep having these conversations without ads or sponsors is because of listener support. If you've found value in these episodes, you can help keep the show going by visiting buymeacoffee.com/fexingo. Every contribution goes directly into production time and guest outreach. No pressure, just a quiet option for anyone who wants to be part of it. Luna: Yeah, it's a simple way to give back if these stories have helped you in any way. And we really appreciate every bit of support. Lucas: Anyway, back to Sarah. The transparency reports became a sort of accidental marketing tool. One of their blog posts about their revenue breakdown got picked up by a newsletter, and they got 200 new signups in a weekend. Luna: So the vulnerability disclosure turned into a whole brand philosophy. Lucas: Exactly. And I think that's the real lesson for founders. You can't plan for a crisis, but you can plan your response framework. Sarah's framework was: 'If something goes wrong, we'll tell the truth, we'll tell it fast, and we'll tell it with a plan.' That's a policy anyone can adopt today. Luna: But what about legal risk? I imagine Sarah's lawyers were not thrilled. Lucas: They weren't. But Sarah made a calculation. She said, 'We're a tiny startup. If we get sued, we're dead anyway. But if we lose trust, we're dead for sure.' And she was right. The legal risk of a public postmortem is actually lower than you'd think, as long as you avoid admitting negligence or violating NDAs. Most security disclosures are protected under safe harbor if done responsibly. Luna: So it's not just brave, it's smart. Lucas: It's both. And I think that's the combination that makes a great founder — courage and calculation. Sarah had the courage to be vulnerable, but she also calculated the upside. She knew her customers were technical buyers who would respect technical honesty. Luna: That's a good point about knowing your audience. If her customers were non-technical, the postmortem might have scared them more than reassured them. Lucas: Absolutely. A B2C company with non-technical users might need a different approach — more simplified, less technical. But the principle still holds: acknowledge the problem, explain what you're doing, and invite feedback. Luna: I wonder if there are any examples of transparency backfiring. Lucas: There are. One that comes to mind is a food delivery startup that published a post about how their unit economics were terrible — they were losing money on every order. Customers started questioning the company's viability, and orders dropped. The difference there is that the transparency wasn't paired with a solution. They just said 'we're losing money' without saying 'here's how we're fixing it.' Luna: So the action plan is the critical piece. Lucas: Right. Transparency without a path forward is just complaining. Sarah's postmortem included a specific list of improvements: new code review process, third-party security audit, bug bounty program. She gave people something to believe in. Luna: It's almost like she treated the vulnerability as a product feature request from the universe. Lucas: That's a great framing. She took a negative and turned it into a positive signal about the company's maturity. And that's the kind of reframing that separates founders who survive from founders who thrive. Luna: So for a founder listening right now who's facing a similar situation, what's the one concrete step they should take today? Lucas: Draft a postmortem template before you need it. Think about what categories you'd include: what happened, why it happened, how you fixed it, what you're doing to prevent it, and what customers should do. Then when a crisis hits, you're not writing from scratch — you're filling in a template. That speed is everything. Luna: And maybe run it by a trusted customer first, as a sanity check? Lucas: Smart. Sarah actually did that. She sent a draft to their three biggest customers before publishing, asking for feedback. Two of them said 'publish it,' and one said 'maybe tone down the technical details.' She adjusted based on that. Luna: So transparency doesn't mean recklessness. It means strategic vulnerability. Lucas: Exactly. And I think that's a mindset every founder can cultivate. Not just in crisis, but in everyday communication with customers, investors, and employees. The default should be: share more, not less. Luna: I think that's a great note to end on. Next episode, we'll look at another founder who used an unconventional approach to solve a common problem. Lucas: Looking forward to it. Thanks for joining us.