Is your Bubble app exposing data?
Bubble lets you build and launch a full web app without writing code — and that's exactly why the security settings are easy to miss. There are no keys or source files to worry about here; the risk lives in one place: the Data API and the privacy rules that are supposed to guard it. Get those wrong and your database is a public URL away. Here's what to check, in about ten seconds.
Check your Bubble app now
Paste your app's URL. The free scan reads it from the outside and checks whether your Data API returns records without a login. No signup, nothing changed.
Only scan apps you own or have permission for.The short answer
Bubble is a legitimate no-code platform, and a properly configured Bubble app can be perfectly safe. But apps built on it are not safe by default once they hold real data. Bubble can expose a public Data API for each of your data types, and the privacy rules that decide who can see what are yours to set. When the Data API is on and privacy rules are missing, a single request to /api/1.1/obj/user can return every record you store — names, emails, whatever is in the field — with no login at all.
We scanned 22,307 live Bubble apps. Most were locked down — but 3,468 were handing out records through an open Data API to anyone with the URL, no login required. From the outside you can't tell which group you're in without checking.
Based on Bubble apps we could reach and scan passively (read-only) from the outside, as of September 2026. Aggregate figures only; no individual app is identified.- Locked down 18,777 · 84%
- Exposing data 3,468 · 16%
- Needs a look 62 · 0.3%
Scan outcome across 22,307 live Bubble apps. Almost every exposed app was leaking through an open Data API. Passive, read-only scans, September 2026.
What can go wrong in a Bubble app
Data API open without privacy rules
The big one. If a data type has the Data API enabled and no privacy rule, a public GET /api/1.1/obj/<type> returns every record — often including a User type full of emails and personal fields.
Permissive default privacy rules
When a type has no rule, the default can leave all fields visible to everyone. Even a type you thought was internal can leak sensitive fields to the API and to the app's own client-side data.
Unprotected backend workflows
Backend workflows exposed as API endpoints will run for anyone if "This workflow can be run without authentication" is left on — letting outsiders trigger actions or create records.
Exposed or over-scoped API keys
An admin-scoped Bubble API key that ends up in client code or a shared integration bypasses privacy rules entirely. Treat any leaked key as a full-access key.
Missing security headers
No Content-Security-Policy, HSTS or clickjacking protection on your custom domain. Hardening, but easy to close.
Bubble as a platform is fine — this is about your app's privacy rules, which are yours to control. The point isn't to avoid Bubble; it's to check independently what your Data API is handing out before real users find it.
How to check your Bubble app
- In Settings → API, see which data types have the Data API enabled — each one is reachable over the public REST API.
- For every type with user data, add privacy rules so records are visible only to the right users, and hide sensitive fields.
- Confirm backend workflows exposed as endpoints require authentication, and that no admin API key is exposed.
- Or run the free scan below, which checks from the outside whether your Data API returns records without a login.
Is your Bubble Data API handing out your database?
Find out in about 10 seconds. Free, no signup, read-only.
Only scan apps you own or have permission for.What to do if you find something
- Add privacy rules to every data type that holds user data, restricting both which records and which fields are visible.
- Disable the Data API for any type that doesn't need to be queried externally.
- Require authentication on backend workflows exposed as API endpoints.
- Rotate any exposed API key and keep admin-scoped keys out of client code and shared integrations.
- Re-scan to confirm your Data API no longer returns records without a login.
Is Bubble safe to use?
Yes — with a few deliberate steps. Bubble hands you a real database and a public API, which is powerful and exactly why privacy rules matter. Set a privacy rule on every data type, turn off the Data API where you don't need it, and lock down your backend workflows, and a Bubble app can be perfectly safe. The scan above tells you, in seconds, whether yours is locked down.