Bubble app security check
Built your app with Bubble? Paste your live link and get a free score before you share it. Under a minute, no sign-up.
Only scan apps you own or have permission to scan.
What to check on a Bubble app
Bubble runs hosting, the database and workflows for you, so you can go live without writing code. What stays in your hands is who can see each record and where your API keys live.
Anything your app sends to the browser can be read by any visitor. That includes option sets, page names and any API Connector value that isn't marked Private. Privacy rules decide which records and fields each user can see.
What the free scan checks
- Leaked keys in your frontend
Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.
- Files left on the server
Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.
- Public source maps
We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.
- Security headers and CORS
HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.
Bubble pre-launch checklist
- Set privacy rules for every data type. In Data, Privacy, add rules so each user only sees their own records, and check what "Everyone else" can view and find in searches.
- Mark API keys as Private. In the API Connector, tick Private for every key or token so it stays on Bubble's server. Prefer "Private key in header" authentication.
- Keep secrets out of public places. Never put keys in option sets, page text, custom states, URL parameters or default field values. Those reach the browser.
- Turn off what you don't use. In Settings, API, leave the Data API and public backend workflows off unless you need them.
- Test as a second user. Sign up with another account in a private window and confirm it can't see the first account's data.
- Run the free scan. Fix anything critical or high first.
FAQ
- Does it work on bubbleapps.io and custom domains?
- Yes. Paste the public link people use to reach your app, either the bubbleapps.io address or your own domain.
- Does it check my privacy rules?
- No. It only sees what your live site serves to a logged-out visitor. Review privacy rules in Bubble, use Bubble's own security tools if your plan includes them, and test with a second account.
- Do I need to sign up?
- No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
- What does it cost?
- The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
- Does it attack my site?
- No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
- What doesn't it check?
- Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.