Check Bubble security
Is your Bubble app production-ready?
Free, platform-independent scan built for Bubble apps. It checks the gaps typical for Bubble — access control, visible keys, GDPR — and delivers a traceable Go/Iterate/Stop verdict with versioned rule codes.
Scan your Bubble app for free nowTypical weaknesses in Bubble apps
Bubble apps run some logic in the client — privacy rules, visible API keys and open workflows are the typical weaknesses.
Rules the scan weights for Bubble
Supabase service_role key in the client
Decodes JWTs in the bundle and reports the `service_role` claim, which bypasses RLS entirely.
RSC-SEC-015Database tables granted to the anon role
Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.
RSC-SEC-018Protected area guarded only in the browser
Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.
RSC-SEC-050Tables without Row Level Security
Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.
RSC-SEC-051RLS policy allows everyone
Finds policies with `using (true)` — RLS is on but has no effect.
RSC-PRV-001Google Fonts loaded at runtime
Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.
RSC-PRV-002US tracking without visible consent
Detects analytics and pixel scripts with third-country transfer in the shipped markup.
Frequently asked
- Is the scan free for Bubble apps?
- Yes. The external scan is completely free and anonymous — you only enter the URL of your Bubble app.
- Do you need access to my Bubble account?
- No. The scan only inspects what your app serves publicly. It goes deeper optionally via read-only repo access or after a domain proof — both strictly opt-in.