!
The whole table is public
Bubble’s Data API is enabled, and a Data Type has no real privacy rules. Anyone with the URL can list every record - customers, orders, messages - in plain JSON. The most common serious leak we find.
← Back to home
Bubble security & data leaks
Your Bubble app is leaking data. Let’s fix it.
Most Bubble apps expose data they shouldn’t - customer records, internal fields, whole tables - through the public data API. We find every leak, fix the privacy rules properly, and lock the app down. Fast, and without breaking what works.
By an ex-Airdev engineer who knows exactly how Bubble’s privacy model fails - and how to fix it properly.
The four ways Bubble apps leak data.
We find at least one of these in most Bubble apps we audit. They don’t show up in the UI - you only find them by querying the API the way an attacker would.
!
Hidden fields aren’t actually hidden
A field is hidden in the UI but fully readable via the API. Salaries, emails, internal notes, payment details - returned in full to anyone who asks, because the privacy rule protects the record but not the field.
!
Privacy rules that fail open
A rule that references a deleted user or an empty field can silently stop applying - and Bubble defaults to exposing the data. The app looks secure until the exact edge case hits.
!
Back-door access via related records
Type A is locked down, but it links to Type B which is wide open - and B contains the same sensitive data. Attackers read through the side door you forgot about.
How we lock your app down.
Critical leaks get closed in days, not weeks. The full hardening follows on an agreed plan - with your app live throughout.
012-5 days
Audit
We probe your live app the way an attacker would - the data API, every Data Type, parameterised queries, direct record lookups, related-record back doors. You get a written report of every exposure, ranked by severity.
You walk away with
A prioritised list of every data leak and privacy-rule gap, with proof and severity.
021-2 days
Triage
We separate the bleeding-now from the merely-risky. Critical exposures (public customer data, payment info) get an emergency fix immediately. Everything else gets sequenced into a remediation plan.
You walk away with
An agreed remediation plan, with the critical leaks already being closed.
03varies by app
Remediate
We rebuild the privacy rules properly - field-level where it matters, deny-by-default, defensive against the fail-open edge cases. We disable the Data API where it shouldn’t be on, lock down auto-bind, and close the back doors.
You walk away with
Every identified leak closed, with the fixes tested against the original exploit.
041-2 days
Verify & harden
We re-run the full audit to prove the leaks are closed, confirm normal app flows still work, and document the security model so your team can keep it that way. Optional ongoing monitoring.
You walk away with
A clean re-audit, a documented security model, and a hardened app.
What we fix.
The full range of Bubble-specific security issues - the ones a generic pen-tester misses because they don’t know the platform’s model.
- Data API exposure - disabled where it shouldn’t be on
- Privacy rules rebuilt - field-level, deny-by-default
- Fail-open edge cases - made defensive so rules never silently lapse
- Auto-bind abuse - locked down so users can’t edit fields they shouldn’t
- Related-record back doors - closed across linked Data Types
- Public endpoints - audited and restricted to authenticated users
- Webhook signature verification - added where integrations are unverified
- A documented security model - so your team keeps it locked down
A generic pen-test won’t find Bubble’s leaks.
Bubble’s security model is specific - privacy rules, the data API, option sets, auto-bind, the way rules fail open. A security firm that doesn’t live in Bubble will run their standard scan, find nothing in the standard places, and miss the leak that’s sitting in plain sight in the data API.
We built Bubble apps at Airdev and operate Ohana, a Stripe Connect marketplace. We know exactly where Bubble apps leak, because we’ve secured our own.
Bubble-native expertise
We know the privacy model, the data API, and the exact failure modes. We find what generic scanners can’t.
Fix, don’t just report
Most security audits hand you a PDF of problems. We close the leaks - and prove they’re closed.
Fast on the critical stuff
Bleeding-now exposures get an emergency fix in days. We don’t make you wait on a six-week engagement to stop the leak.
No disruption
Your app stays live. We fix the security without breaking the flows your users depend on.
When the leak is a sign of something bigger.
Sometimes a data leak is a one-off fix. Sometimes it’s a symptom - an app that’s outgrown what Bubble’s privacy model can safely express, where the security work is really an argument for a migration to a code stack with real row-level security.
We’ll tell you honestly which one you are. If a clean fix secures you for years, that’s what we do. If the leak is the tip of an iceberg, we’ll say so - and stop the bleeding first either way.
Common questions.
How do I know if my Bubble app is leaking data?+
The fastest way is our free scan - we probe your app's data API from the outside and tell you what's exposed. Most owners are surprised. If you want to check yourself: open your app's data API URL (yourapp.com/api/1.1/obj/{datatype}) in an incognito window. If you get records back without logging in, that data is public.
How fast can you fix a critical leak?+
Critical exposures - public customer data, payment info - get an emergency fix in days, often within 48 hours of starting. We stop the bleeding first, then work through the full remediation on an agreed plan.
What does it cost?+
We quote after a short call and (usually) a scan, because the cost depends on how many Data Types and rules are involved. A focused leak fix is far cheaper than a full security overhaul. Either way it's fixed-scope, fixed-price - no open-ended billing.
Will fixing the security break my app?+
Done carelessly, tightening privacy rules can break flows that quietly depended on the leak. We test every fix against your real app flows, so we close the exposure without breaking what your users do. Your app stays live throughout.
Isn't this just a job for a regular security firm?+
Generic security firms run standard scans and miss Bubble-specific leaks - they don't know the data API, privacy rules, or auto-bind. Bubble's exposures sit in places a standard pen-test doesn't look. You need someone who knows the platform's model.
Do you offer ongoing security monitoring?+
Yes, as an optional retainer after remediation. We periodically re-audit so a future change doesn't quietly re-open a leak. Most apps start with a one-off fix and add monitoring if they're handling sensitive data at scale.
Related reading.
Stop the leak today.
Book a call and we’ll look at your app live. If it’s leaking, we’ll tell you exactly what’s exposed and how fast we can close it.
No NDA needed to start. We treat what we find as confidential.