A security researcher, a Waldorf teacher, and an interior designer crossed 100 paid subscribers
Three solo newsletters — exploit research for security engineers, Waldorf pedagogy essays, and interiors writing — each took a first Substack Bestseller badge in the past month; this issue breaks down what they charge, where each drew the paywall, and the move that took them over the line.
The October screen turned up three newsletters from three working lives. One publishes exploit analysis, one pedagogy essays, one design writing: a senior security researcher, a Waldorf teacher of thirty years, and an interior designer with a studio of her own.
All three are solo operations. All three keep their audience under 5,000, and each took a first Substack Bestseller badge between September 23 and October 23, 2026. They charge $8, $6 and $6 a month. The smallest, at 959 subscribers, reached a hundred paying readers on about a tenth of its list.
How this screen works
Substack awards its white Bestseller badge at a hundred paid subscribers. The count takes active plans, and leaves out free trials, gifts and group passes. 1
The badge sets the floor on paid readers. The number a publication renders on its own subscription page sets the ceiling on total audience. 2
Substack's New Bestsellers list carries the publications that took a first badge in the previous thirty days. 3 This screen sweeps that list against three gates. The author must be one person, the total audience must sit under 5,000, and the first badge must fall inside the window.
Case 1 — Man in Cybersecurity
Positioning and audience
Man in Cybersecurity publishes vulnerability research for people who defend systems for a living. Each recent post takes one disclosed flaw and works through what it does and what a fix leaves behind. 4
The subscription page renders 959 subscribers, and the badge puts paid readers at a hundred or more. The tiers run $8 a month, $80 a year, or $240 for a founding annual. 5
Authority and unfair advantage
Qi Deng is a senior security researcher at Palo Alto Networks, working across web, network and system security. 6 His conference record includes a 2021 Black Hat Asia talk, given with two co-speakers, on chaining a SQL injection into IIS and SQL Server. 6
The publication gives that day job a longer form. The free write-up on React2shell, a CVSS 10.0 flaw in React Server Components, runs 656 words and carries its proof of concept. 7
Cadence and post length
The archive holds nine posts since October 2025. Four of them landed between October 19 and October 23, 2026, running 1,863 to 4,612 words, and each dissects a different flaw. 8
One covers an OpenAI agent wallet incident and the bot war that followed. 9 Another takes a PHP session-upload vulnerability, at 4,612 words. 4 The other two read a Node.js remote-code-execution claim that cannot fire, and a certificate-authority key weakness. 1011
The free-to-paid cut
Five of the nine posts are for paying readers, and four of that five went out in five days this October. The open ones are a 656-word React2shell write-up, a 5,238-word history of how security products lag the technologies they protect, and a 2,543-word piece on why security companies fail. 1213
The conversion lever
The paywall switched on with the October run. In the twelve months before October 19 the publication had put out one paid post, a personal one about doing his own green-card petition with an AI model. 14 Between October 19 and October 23 it put out four.
The badge sits at the end of that week. No post explains the timing, and the publication carries no notes, so the dates stand without a cause attached to them.
Who could reproduce the model
The model fits any job that produces analysis the public write-up stops short of. A site reliability engineer's incident teardowns would, or a firmware engineer's notes on one chip family, or a pharmacist's list of interactions a label omits. The price is the tell. At $8 a month this is an expense line for a working engineer, so a list of nine hundred practitioners can carry it.
Case 2 — Waldorf Ways
Positioning and audience
Waldorf Ways is a working teacher's account of Waldorf education: the curriculum, the classroom, the children. Behind each post sit the ideas of Rudolf Steiner. 15
The subscription page renders 3K+ subscribers, and the badge puts paid readers at a hundred or more. The tiers run $6 a month, $50 a year, or $150 for a founding annual. 16
Authority and unfair advantage
Donovan Gay was a Waldorf pupil before he was a Waldorf teacher. He trained at Emerson College in the 1990s, then taught as a class teacher and subject teacher and mentored other teachers, in the UK and in South Africa. 1517
A contributor note at Waldorf Today puts him at more than thirty years in the movement, teaching in the UK, South Africa and now online. 18 In 2019 he moved to Spain and started Waldorf Ways as an online teaching platform. 17
Cadence and post length
One long essay a week, between 2,049 and 4,660 words. Six of them ran between September 13 and October 20, 2026. 19
The subjects are the ones a staffroom argues about. Gay writes on who sets the pace in a lesson and what a main lesson book is for. He writes on what Michaelmas is asking of a school, and on where authority in a classroom comes from. 20212223 The sixth asked whether Waldorf survives without anthroposophy. 24
The free-to-paid cut
The free tier runs on rhythm. Each week brings a Steiner quotation of 67 to 133 words and a short note pointing to a new episode of the Wonderfully Human podcast, 37 to 98 words. 2526
The sixteen free posts in that stretch come to about 2,300 words, and 1,179 of those sit in one essay from September 8. 27 The essays themselves belong to paying readers.
The conversion lever
The paid essay began on August 30, 2026, and the weekly run has held since. 28 The podcast launched at the end of July, with a short post announcing it. 29
Substack places the badge inside the thirty-day window. The publication has posted no account of which essay converted whom.
Who could reproduce the model
A Montessori trainer, a Suzuki music teacher, a special-education coordinator, a trade instructor with an apprenticeship method. The asset is a practice old enough to have second thoughts about. Gay writes about practices he once followed because that was how he had been taught them, and later came to understand differently. 15
Case 3 — Sidenote
Positioning and audience
Sidenote is design writing for people making their own rooms. Its posts take up what a good room is made of, why a paint choice works, and where to spend and where to stop. 30
The subscription page renders 4.5K+ subscribers, and the badge puts paid readers at a hundred or more. The tiers run $6 a month, $60 a year, or $100 for a founding annual. 31
Authority and unfair advantage
Zoë Feldman runs Zoë Feldman Design, a residential studio with offices in Washington and New York. 32 She has worked as a designer for more than twenty years, and Architectural Digest toured the 1920s Washington house she remade for her own family. 33
The newsletter runs one of her projects, Kemble Cottage, from floor plan to millwork, in public. 34
Cadence and post length
Every other week, at 391 to 2,065 words, with a paid post roughly once a month. Seven of the last twenty-three posts are for paying readers. 35
The free-to-paid cut
Free is the essay. Recent ones cover how to choose a white paint, whether a floor plan changes how a family lives, and six ways to collect art at any price point. 363738
Paid answers a reader's own room. It holds a two-part design-dilemmas column and a "You Asked" mailbag. It also holds a guide to splurging and saving in a renovation, and a piece on the small decisions that make a house feel designed. 39404142
The conversion lever
On September 24, 2026, Feldman posted a screenshot of a Substack notification. It read "Zoë Feldman is now #1 Rising in Design", and she added: "This was a fun notification to wake up to!" 43
The day before, she had published the free essay on white paint. 36 Her paid posts had stopped after July, while the free essays kept coming every two weeks.
Who could reproduce the model
A landscape architect, a lighting designer, a cabinetmaker, a set dresser. Each of them makes a body of decisions a client pays for, and each of those decisions is the paid product. The free essay shows the answers are worth following.
Near-miss audit
AFTER REVIEW holds a badge and renders 5.1K+ subscribers at $8 a month, just over the ceiling. 44
Eslimah renders 6.7K+ at $7 a month, well over it. 45
Word Layout, a graphic designer's journaling letter, renders 2.2K+ at $5 a month with the badge. Its two paid posts run 270 and 460 words, so almost nothing sits behind the wall. 4647
Poll Vault, Sean Trende's elections analysis, renders 2.2K+ at $9.50 a month with the badge. It was held back as a second politics letter, in a month that already carried a French politics chronicle in this slot. 48
SHE MAIL, Charlie Craggs's personal letter, renders 1.1K+ at £4 a month with the badge. Its draw is the writer's own following. 49
Three adjacent niches to test
Control-system security for the plant floor. Deng writes for engineers defending web and cloud software. The people who run programmable controllers at a water plant or a packaging line get advisories written in IT vocabulary. Free, one translated advisory a week. Paid, the patch sequence for the equipment on site.
Special-education paperwork. Gay writes for teachers and homeschooling families inside one pedagogy. The parents and new teachers who have to build an individualized education program have no equivalent letter. Such a letter would explain what each document means, what the district owes, and what to bring to the meeting. Free, a glossary and one timeline. Paid, the case file, document by document.
The contractor's side of a renovation. Feldman writes for the person paying for a renovation. The general contractor and the junior designer running the job work from schedules, subcontractor quotes and change orders, and almost none of it is written down in public. Free, one project's diary. Paid, the budget template and the change-order ledger.
What this trio is worth at the milestone
Five hundred paid subscribers at $10 a month is $5,000 a month, or $60,000 a year before platform fees. This week's three show how small a list can be and still reach that arithmetic, and how much the price decides the total.
At Deng's $8, a hundred paid readers is $9,600 a year. Two hundred and fifty is $24,000, and five hundred is $48,000. 5
At Gay's and Feldman's $6, a hundred paid is $7,200 a year, two hundred and fifty is $18,000, and five hundred is $36,000. 1631 Each also sells an annual plan at eight to ten months' price, and a founding annual between $100 and $240.
The conversion ratios differ more than the prices do. Deng needed about a tenth of 959 subscribers to pay. Gay needed about one in thirty of 3,000, and Feldman about one in forty-five of 4,500.
References
- 1Introducing the Substack Bestseller badge
on.substack.com
- 2What is a Substack Bestseller badge?
support.substack.com
- 3New Bestsellers on Substack
substack.com
- 4php2shell: Dissecting PHP's Critical Session Upload Progress Vulnerabilities
qideng.substack.com
- 5Man in Cybersecurity subscription page
qideng.substack.com
- 6Qi Deng, speaker profile
techconf.me
- 7React2shell: RCE in React Server Components and Next.js App Router
qideng.substack.com
- 8Man in Cybersecurity archive
qideng.substack.com
- 9When AI Agents Start Stealing
qideng.substack.com
- 10brotli2crash: The Node.js "Critical RCE" That Can't Actually Fire
qideng.substack.com
- 11Eight CA Private Keys Were Essentially One Byte Long
qideng.substack.com
- 12Why Security Is Always Half a Step Behind
qideng.substack.com
- 13Position and DNA Define the Fate of Cybersecurity Companies
qideng.substack.com
- 14No PhD, No Lawyer, Just AI
qideng.substack.com
- 15About Waldorf Ways
waldorfways.substack.com
- 16Waldorf Ways subscription page
waldorfways.substack.com
- 17Lotus and Ivy: our teachers and staff
lotusandivy.com
- 18A Child Can Use a Phone. But Can She or He Tie a Knot?
waldorftoday.com
- 19Waldorf Ways archive
waldorfways.substack.com
- 20Who Really Sets the Pace
waldorfways.substack.com
- 21What Is a Waldorf Main Lesson Book Really For?
waldorfways.substack.com
- 22What Is Michaelmas Really Asking of Us?
waldorfways.substack.com
- 23If You Have to Keep Asserting Authority, You Don't Have It!
waldorfways.substack.com
- 24Waldorf Without Anthroposophy: Is It Still Waldorf?
waldorfways.substack.com
- 25This Week's Steiner Quote
waldorfways.substack.com
- 26A New Episode of Wonderfully Human
waldorfways.substack.com
- 27The Lesson You Planned Doesn't Exist Yet
waldorfways.substack.com
- 28I Am Not Starting From Scratch
waldorfways.substack.com
- 29A New Podcast: Wonderfully Human
waldorfways.substack.com
- 30About Sidenote
zoefeldman.substack.com
- 31Sidenote subscription page
zoefeldman.substack.com
- 32Zoë Feldman Design
zoefeldmandesign.com
- 33Tour a 1920s Washington, DC, Home
architecturaldigest.com
- 343 Aesthetic Obsessions Shaping Kemble Cottage
zoefeldman.substack.com
- 35Sidenote archive
zoefeldman.substack.com
- 36Choosing the Right White Paint
zoefeldman.substack.com
- 37Can A Floor Plan Make Your Family Closer?
zoefeldman.substack.com
- 386 Ways to Collect Good Art at Every Price Point
zoefeldman.substack.com
- 39Your Design Dilemmas, Solved (Pt. 2)
zoefeldman.substack.com
- 40You Asked...
zoefeldman.substack.com
- 41A Designer's Guide to Splurging and Saving During a Renovation
zoefeldman.substack.com
- 42The Small Decisions That Make a House Feel Designed
zoefeldman.substack.com
- 43Zoë Feldman's note, September 24, 2026
substack.com
- 44AFTER REVIEW subscription page
afterreview.substack.com
- 45Eslimah subscription page
eslimah.substack.com
- 46Word Layout subscription page
wordlayout.com
- 47Paid Content #01
wordlayout.com
- 48Poll Vault subscription page
pollvault.substack.com
- 49SHE MAIL subscription page
shemail.substack.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.