A 15 minute security checklist for your Bubble app
Bubble says that since mid-October 2026 an AI-powered threat actor has targeted the Bubble platform and the apps it hosts, and it published its response on 3 November 2026. Bubble's advice is that it defends the platform and the building blocks, while you secure your app's own business logic. A 15 minute pass over seven areas covers the settings that matter most: privacy rules, API keys, backend workflows, plugins, admin and role checks, rate limits and logs.
What Bubble has said
We are not Bubble and we have no inside knowledge of the incident, so here is only what Bubble itself says in its post of 3 November 2026, written by Joshua Haas. Bubble says it does not know who is behind the campaign. It says that on 26 October the actor got partial access to its production systems and could reach some user data, including private data uploaded by plugin developers, and it links a preliminary root cause analysis. It says it is now using AI to detect and block bad requests before they reach your app.
For app owners, Bubble points to two tools. The Bubble security dashboard runs checks for common configuration problems, including credentials that are not marked private, misconfigured API Connector calls and privacy rules with holes. Bubble's MCP lets an AI assistant explore your app, and Bubble suggests a read-only prompt that asks it to flag security issues without changing anything. Bubble recommends using both. The checklist below is our own, and it works alongside them.
The 15 minute checklist
- Privacy rules on every data type (3 minutes). Open the Data tab and look at each data type, including the ones you forgot about. A type with no rule is open to anyone who can query it. Check that the rule for everyone else grants as little as possible, and that "find this in searches" is only on where a search genuinely needs it. Then test as a logged-out visitor and as an ordinary user. Our guide on privacy rules and search results shows how to read what a rule really exposes.
- API keys marked private (2 minutes). In the API Connector, open each API and check that every key, token and secret in a header or parameter has Private ticked. A value that is not private can be seen in the browser. If you find a live key that was exposed, replace it at the provider, not just in Bubble.
- Backend workflows and the Workflow API (3 minutes). In Settings, on the API tab, see whether the Workflow API and the Data API are switched on. If you do not use them, switch them off. For each backend workflow, check whether it is exposed as a public API workflow, whether it needs authentication, and whether "ignore privacy rules" is ticked. A public workflow that ignores privacy rules and accepts any input is a front door.
- Plugins (2 minutes). List the installed plugins and remove the ones nothing uses. For each one you keep, ask who maintains it, when it was last updated, and what it can read or send. Bubble's own post mentions private data uploaded by plugin developers, so also check which plugins hold keys or settings that you could rotate.
- Admin and role checks (2 minutes). Hiding a button does not protect anything. Check that role tests sit in the privacy rules and in workflow conditions, not only on the page. Count your admin users and remove any you do not recognise.
- Rate limiting (1 minute). Look at the workflows an attacker would repeat: sign-up, log-in, password reset, anything that sends email or text, and anything that calls a paid API. Add a check on how many recent attempts a user or address has made, and set spending limits at your API and email providers.
- Logs to watch (2 minutes). Open the server logs and your app metrics. Look for bursts of API workflow calls, repeated failed log-ins, sign-ups you do not recognise and sudden jumps in workload units. A spike worth explaining is often the first sign. If something looks wrong, check Bubble's status page, which Bubble says it uses to post updates when a security measure affects customers.
After the 15 minutes
Write down what you found and fix the privacy rules first, because they decide who can read your data. Put a repeat on the calendar: Bubble says it does not know whether the attacks will stop and has told its own team to assume this is the new normal, so a one-off check is not enough.
If you want a second opinion, our Privacy Audit checks every data type and tests as real user roles, including exposure through the Data API and API workflows. App Triage gives you a written diagnosis and fix plan for an app that is broken, slow or costly. If your app was built mostly with AI tools, the AI-Built App Audit is a report-only review of access rules, sign-in, exposed keys and payments. For a repair, see App Rescue and Move to Cloudflare and API Rescue. Prices are on each page.
Sources
- Security Is Now the Most Important Topic in Tech, Bubble blog, Joshua Haas, 3 Nov 2026
- Preliminary RCA: October 2026 Security Incident, Bubble blog, 26 Oct 2026
- Bubble security dashboard, Bubble