bubbleio.wtf
bubble security scanner: live

Is your Bubble app leaking API keys?

Bubble sends part of your app to every visitor's browser. Paste its URL and we count the API keys anyone can read there.

Free, no sign-up. Reads the public bundle only; nothing is written to your app. To see which keys leaked and how to fix them, verify you own the app.

sample output

Illustrative. Not a real app, not real keys.

$ scan your-app.bubbleapps.io
> reading public page bundle… done
> stripe secret key   sk_live_••••••••••••••••  exposed
> openai api key      sk-proj-••••••••••••••••  exposed
> 2 exposed keys. verify ownership to see where they leak and how to fix them.

who's behind this

I'm Rico Trevisan, an independent developer (rico.wtf). If I emailed you about your app, this is the scanner I used. Help fixing the leaks is free, with no strings attached.

next: move it to code

Keys keep leaking because Bubble runs logic in the browser. Rewritten as a Phoenix application, secrets stay on the server. Migrations open soon; the blueprint of your data model is live today.

One email when migrations open, plus occasional build notes.

By signing up, you opt into launch updates. See the privacy policy.