Search returns nothing: privacy rules hiding results
A search only returns records the current user is allowed to find, so privacy rules can quietly make results look empty or short. Test as the affected user with Run as, then fix the rule that grants access. In 2026 Bubble also added search privacy constraints, which can change results for searches that filter on protected fields.
What is happening
Bubble's privacy rules grant access rather than block it. In other words, nothing is visible until a rule allows it. A user can only find a record in Do a search for if a rule that applies to them has Find this in searches checked. When no rule grants it, the record is not returned, so the page can look empty or short even though the data exists.
Searches inside page workflows run as the current user too. The official manual states that such a search only returns data the current user has access to.
Search privacy constraints (2026)
Bubble introduced search privacy modes in 2026: Strict, Automatic and Off, set in Settings, General. Each field now has separate View, Constraint and Auto-bind permissions. According to the official support documentation, apps created after July 7, 2026 default to Strict, existing apps were set to Automatic, and a search that constrains on a field the user is not allowed to constrain on may stop returning results or behave differently. If a search broke without any change to your rules, check this setting and the field's Constraint permission.
How to fix it
- Reproduce it as the affected user. In the Data tab, under App data, use Run as on that user. Bubble runs the app as if you were that user. Do not edit anything until you log out again.
- Check the rules on the data type. Open Data, Privacy, select the type, and find which rule should apply to this user. Confirm its condition is actually true for them, and that Find this in searches is checked. Remember the Everyone else rule covers anyone no other rule matches.
- Check search constraints. If the search filters on a field, confirm the user has the Constraint permission for that field, or review your app's search privacy mode.
- Check development and live separately. The two versions have separate databases, so test data can differ.
- Use the right tool for admin jobs. If a backend process genuinely needs to see everything, run it as an API workflow with Ignore privacy rules when running the workflow checked. The official manual describes that option for API workflows. Do not loosen a rule for everyone just to make one admin screen work.
- Run the privacy rules checker. The Security Dashboard includes a privacy rules checker that helps you review exposure after you change rules.
Triage / $99
Approximately 1 hour of work. Determining issues and coming back to you with a plan.
Pay $99 and book