Zeepler

Thermal label printers in hospitals, warehouses and evidence rooms speak ZPL, Zebra’s printer language: a stream of caret commands with coordinates in printer dots. Every team that prints labels from its own software ends up hand-writing ZPL strings, and the bugs only show up on paper.

Zeepler takes the label as JSON (a size, the data and where each field goes) and returns ZPL ready to send to the printer. It’s a Bates Solutions product: an API with accounts, keys, metering and billing, so it has to be run like a business, not a script.

• The generator. Text, QR codes and Code 128, Code 93 and EAN-13 barcodes, placed on 3×1 and 4×2 inch labels at 203 dpi. Values containing ZPL’s control characters are hex-escaped, so a name on a label can’t close its field and run printer commands.
• Accounts and keys. Self-service sign-up through Cognito. API keys are random, shown once, and stored only as a SHA-256 hash. Each key has its own rate limit and each account a spending limit.
• Metering and billing. Every generated label writes a usage row, and a rejected request is never billed. On the 1st of each month a scheduled job bills the previous month through Square, charging a saved card or sending an invoice, with every call keyed for idempotency. A signature-checked webhook marks invoices paid, and an hourly poller is the backstop.
• Two regions. Customers choose the US or Canada at sign-up. Their Cognito account, API keys, usage and billing records live only in that region, and nothing is replicated. Square, Cloudflare Turnstile and the site’s CDN are shared.
• Operations. Terraform owns production, and CI deploys on merge through GitHub OIDC, Canada first as a canary. The site is checked against WCAG 2.1 AA with axe in a real browser on every change. Nothing from a request body is logged, because labels carry names and case numbers.

The sign-ups that weren’t customers

An AWS account audit in August 2026 showed 3,082 users in Zeepler’s user pool and 15 API requests in 30 days. Those two numbers can’t both be real. They weren’t: 3,073 of the users were unconfirmed junk.

From December 2025 until it stopped in early August, a bot had called Cognito’s public sign-up API directly, about once every 33 minutes, around the clock, with no bursts. It never touched the site or the API, so nothing that watched traffic would have seen it, and nothing was watching.

The accounts were harmless. The mail wasn’t. Every sign-up made Cognito send a confirmation code to a scraped address, and the bounces and complaints counted against the AWS account’s email reputation, which every product on the account shares. The complaint rate had reached 0.13%, over Amazon’s 0.1% limit.

The fix ran in order:

1. Closed self-registration, and replaced the sign-up form with a waitlist that never mails the address it’s given.
2. Turned on the account’s bounce and complaint suppression list, and added alarms for bounces, complaints, mail volume and sign-ups.
3. Backed up all 3,082 users, deleted the 3,073 junk ones, and confirmed no orphaned rows were left behind.
4. Reopened sign-up behind a Cognito pre-sign-up check that verifies a Cloudflare Turnstile token and fails closed.

The last step is the one that matters. The browser calls Cognito directly, so there’s no API Gateway in front of sign-up to put a check in. The pre-sign-up trigger is the one place that runs before Cognito sends any mail. A rate limit wouldn’t have helped either: one sign-up every half hour is far below any threshold. The sign-up alarm catches bursts, and its own comment says it wouldn’t have caught this one, which is why the gate had to be the real fix.