Is your Bubble app leaking API keys?
Bubble sends part of your app to every visitor's browser. Paste its URL and we count the API keys anyone can read there.
sample output
Illustrative. Not a real app, not real keys.
$ scan your-app.bubbleapps.io
> reading public page bundle… done
> stripe secret key sk_live_•••••••••••••••• exposed
> openai api key sk-proj-•••••••••••••••• exposed
> 2 exposed keys. verify ownership to see where they leak and how to fix them.Top confirmed key leaks
Providers whose keys a scan found live in a public Bubble bundle: the provider accepted the key when it was checked. Findings nobody could confirm - an expired token, a webhook no provider will verify - are not counted.
Confirmed live leaks per provider
- 01 Slack webhook 532 68.9%
- 02 Apify 48 6.2%
- 03 Slack 40 5.2%
- 04 Discord webhook 28 3.6%
- 05 Stripe 26 3.4%
- 06 HubSpot 22 2.8%
- 07 Shopify 21 2.7%
- 08 Twilio 20 2.6%
- 09 SendGrid 19 2.5%
- 10 IPInfo 16 2.1%
Bars are scaled relative to the largest provider; percentages show each provider's share of the 772 confirmed live keys in this list. The scale is not padded to make the tail look bigger. Based on more than 15329 public bundle scans, each one asking the provider whether the keys it found still work.
who's behind this
I'm Rico Trevisan, an independent developer (rico.wtf). If I emailed you about your app, this is the scanner I used. Help fixing the leaks is free, with no strings attached.
next: move it to code
Keys keep leaking because Bubble runs logic in the browser. Rewritten as a Phoenix application, secrets stay on the server. Migrations open soon; the blueprint of your data model is live today.
One email when migrations open, plus occasional build notes.