Getting started
How the exposed-key scan works
What the bubbleio.wtf scanner reads, how it detects exposed provider keys in public Bubble app bundles, and what it does and doesn't prove.
The scanner’s job is to find provider API keys that Bubble ships into the browser and that a visitor can therefore extract.
What it reads
Bubble publishes an app’s runtime configuration as public assets. The scanner downloads those bundles and looks for known provider credential shapes, including API keys, tokens, secrets, and connection strings that Bubble or a plugin embedded in the client bundle.
The scan is read-only: it never modifies anything and it works only from public assets your app already serves.
What the signals mean
A hit means a credential-shaped value was found in a public bundle. That is a strong signal of exposure risk, but it is not proof of exploitation. The distinction matters:
- A scan hit is a diagnostic. The key reached the browser and is extractable.
- It is not a claim that the key is currently being abused.
That is why the leaderboard at /top is framed as “exposed key patterns” and scan-hit signals, not as confirmed breaches.
What it doesn’t do
- It does not rotate or revoke keys.
- It does not prove a key is live or in active use.
- It cannot see server-side secrets that never reached the browser.
The correct response to a hit is to treat the key as compromised: rotate it, move it server-side, and keep it out of public configuration going forward.