AI App Builder Audits · AI Development Series
Bubble App Audit
Bubble can build genuinely complex applications. Almost everything about whether yours is safe comes down to one feature most people configure once and never revisit.
What Bubble actually hands you
Bubble is the most capable no-code platform there is, and applications built on it can be genuinely sophisticated. It is also entirely proprietary: there is no code to export, and the application only runs on Bubble.
What a Bubble application is made of
- Application Bubble's visual editor, no exportable code
- Database Bubble's own, organised as data types
- Access control Privacy Rules, set per data type
- Logic Workflows, built visually
- API Data and workflow APIs, optionally exposed
- Hosting Bubble only, priced by workload units
The single most important thing to understand about Bubble security is that hiding something on a page does not protect it. Bubble applications fetch data to the browser and then display part of it. Conditional visibility, hidden elements and page-level restrictions all operate after the data has already arrived.
What actually restricts data is Privacy Rules, configured per data type. If those are not set, the data is reachable — through the browser's network traffic, and directly through Bubble's data API if it is enabled. This is the most common serious finding in Bubble applications by a wide margin, and it has produced real, public breaches.
What we consistently find
These are the recurring issues in Bubble applications.
Privacy Rules never set
By default a data type is readable. Applications get built, the interface shows each user the right things, and Privacy Rules are left as they were because nothing appears to be wrong.
Anyone can open the browser's network tab and see the full records behind the page, including fields the interface never displays. If the data API is switched on, they do not even need the app.
What it costs you: complete exposure of the data behind your app. Reportable under UK GDPR.Fields nobody meant to send
Even where Privacy Rules exist, they are often set to restrict which records a user can see without restricting which fields come with them. Internal notes, cost prices, other people's email addresses and admin flags travel to the browser attached to records the user is legitimately allowed to see.
None of it is on screen, so nobody notices. All of it is in the response.
What it costs you: commercially sensitive fields leaking alongside legitimate data.Workflows that trust the browser
Client-side workflows run in the user's browser and can be observed and manipulated. A workflow that calculates a price, applies a discount or sets a permission level on the client is a suggestion rather than a rule.
Anything that must be true needs to happen in a backend workflow, where the user cannot reach it.
What it costs you: users able to influence prices, permissions and outcomes.A bill driven by how things were built
Bubble charges by workload units, which are consumed by searches, workflows and page loads. An inefficient repeating group or a workflow that runs more often than it needs to costs money on every single view.
Applications built visually accumulate these quietly, and the first sign is a bill that has grown much faster than your user numbers.
What it costs you: running costs that scale with inefficiency rather than with success.Where Bubble is genuinely good
Bubble deserves genuine credit. It is the most capable platform in no-code by some margin, real businesses run on it, and it lets people build things that would otherwise have needed a development team they could not afford.
Genuinely well suited to
- Complex applications built by non-developers
- Marketplaces, directories and internal systems
- Businesses without a development team
- Validating a product properly before investing in a build
- Applications where iteration speed matters more than control
Where it needs engineering behind it
- Anything where Privacy Rules have not been deliberately designed
- Applications holding health, financial or special-category data
- Systems facing a client or investor security review
- Workloads where the per-unit cost becomes significant
- Anything you may need to run independently of Bubble one day
The honest summary: Bubble is powerful enough to build a real business on, and its security model is entirely opt-in. The gap between an app that looks right and an app that is protected is one feature wide, and it is the feature people most often skip.
Prefer to watch? The short version of who we are and how we work
Do you need an audit?
Get it looked at if
- More than one customer or organisation uses it
- It stores personal data of any kind
- You cannot confidently say what your Privacy Rules allow
- The data API is enabled and you are not sure what it exposes
- Your workload unit costs have grown faster than your users
You are probably fine if
- You are the only person who uses it
- It holds nothing you would mind losing or leaking
- It is a prototype and everyone treats it as one
- It shows only public information and collects nothing
Questions about auditing a Bubble build
The data types and how they are structured, the Privacy Rules on each one, what the data API exposes, and where your workflows run. That is where the real decisions in a Bubble app live. We look at it the way an attacker would: not what does the interface show, but what does the platform actually return if I ask it directly.
Usually not. Rebuilding a working Bubble application as custom software is expensive and often unnecessary, and most of what we find is fixable inside Bubble — tightening Privacy Rules, moving workflows server-side, restructuring an expensive search. We would rather you spent that money on the business. Where a rebuild genuinely is the answer, it is normally cost or a compliance requirement rather than the platform being wrong.
No, and we would rather say so plainly than pretend otherwise. We build with Claude Code and Cursor, with senior developers designing the system, reviewing every change and testing it. What makes us useful here is not Bubble expertise, it is that the thing being audited is a data model and a permission scheme, which is what we have been working with since 2008.
Built with something else?
We audit what these tools produce, whichever one you used.
Other AI app builders
- Lovable app audit
- Emergent app audit
- Replit app audit
- UI Bakery app audit
- Bolt app audit
- v0 app audit
- Base44 app audit
- Firebase Studio app audit
- Databutton app audit
- Rork app audit
- a0.dev app audit
- FlutterFlow app audit
- Glide app audit
- Softr app audit
- Adalo app audit
- Retool app audit
- Appsmith app audit
- Budibase app audit
- ToolJet app audit
- Xano app audit
- Airtable app audit
The audit
Find out what you are sitting on
The AI Code Audit is £495, fixed.
Tell us roughly what you built and how many people use it. If an audit is not the right thing for you, we will say so.
What the report covers:
- Privacy Rules on every data type, and what they really allow
- What your data API exposes to anyone who asks it directly
- Which workflows run in the browser when they should not
- What is driving your workload unit costs
We reply within one working day.
