guide · bubble.io
How to check your Bubble app isn't leaking user data
updated 2026.09.21 · vardha solutions
The most common serious issue in Bubble apps isn't a bug — it's data that the pages never show but anyone can still retrieve. Bubble gives you the tools to prevent it. This checklist walks through how to confirm you're using them.
Why hiding data on the page isn't enough
When a page runs a search, Bubble sends the matching records to the browser. If a data type has no privacy rules, the browser can receive fields you never display — email addresses, phone numbers, internal notes. Hiding an element or filtering a list on the page doesn't change what was sent.
The checklist
- Every data type has privacy rules. Open Data → Privacy and go through each type. "Everyone else" should see nothing unless there's a clear reason.
- Rules match your roles. Write down who should see what — owner, teammate, admin, visitor — and make sure each rule expresses exactly that, e.g. "This thing's Creator is Current User".
- Sensitive fields are restricted individually. A user may be allowed to see another user's name but not their email. Privacy rules can limit individual fields; use that.
- Searches respect the rules. Check the "find this in searches" option on each rule so restricted records don't appear in search results.
- The Data API is only on where you need it. In Settings → API, confirm which data types are exposed. Anything exposed is reachable from outside your app.
- Backend workflows require authentication. Workflows exposed as public endpoints should not run for anonymous callers unless intended.
- API Connector keys are private. Every key for a paid or sensitive service should be marked private so it stays on Bubble's servers.
- Option sets hold nothing secret. Option sets are sent to every visitor; never store keys or internal data in them.
How to test it
Create two ordinary test accounts. Signed in as the first, try to reach the second user's records: open pages with their IDs, and watch your browser's network tab for data you shouldn't receive. Then repeat while signed out. Anything you can see that you shouldn't, a stranger can see too.
Privacy rules are powerful but easy to get subtly wrong on a large app. If you'd like an independent check before launch, that's part of every Bubble app audit.
Not sure where your app stands? A free 20-minute scan tells you which of these risks apply to your build, and what to fix first.
Book a free 20-min readiness scan