What Bubble's Security Dashboard won't fix for you. Bubble now ships a security scanner that flags your missing privacy rules. Knowing a rule is missing and knowing the right rule are different problems, and the gap between them is where a Bubble app's database stays public. Field Notes from Thunkle, a studio that takes AI-built apps from prototype to secure, production-ready software. Bubble ships a Security Dashboard now. It scans your app, checks your privacy rules, and flags the data types you left open. This is genuinely good, and if you have a Bubble app you should turn it on today. It is also the beginning of the job, not the end, and the difference is worth understanding before you assume a green dashboard means a safe app. I should say plainly that fixing this is something Thunkle sell, so weigh the rest accordingly. The facts underneath it are checkable, which is the point. The one flaw that matters most. Every Bubble app exposes a Data API. It is how the app's own front end reads and writes the database, and it is public by design. What controls who can read what through it is a set of privacy rules you define per data type. Miss them on a data type, and that entire table is readable by anyone who sends a plain, unauthenticated request. Not a theoretical anyone. You can see it on any Bubble app from a terminal: # lists the app's data types curl -s https://APPNAME.bubbleapps.io/api/1.1/meta # returns rows if the User type has no privacy rules curl -s https://APPNAME.bubbleapps.io/api/1.1/obj/user If the second request comes back with records, that data is public to the whole internet. No login, no token, no clever exploit. The app in the browser looks completely normal the entire time, which is exactly why this survives to production. Nothing in the editor turns red. The database is just quietly answering the door to whoever knocks. This is the most common serious finding in Bubble apps, and it is the one the platform built its dashboard to catch. So why is it still worth a human? Flagging a gap is not the same as closing it. The dashboard tells you a data type has no privacy rules. That is the easy half. The hard half is the rule itself, and a scanner cannot write it for you, because the correct rule depends on what your app is for. Who is allowed to read a given row? The user who created it, and no one else? Any logged-in user, but only some fields? A team, defined by a link two data types away? These are questions about your product, not your code, and the answer is different for every table. Set the rule too tight and the app breaks in ways that are obvious. Set it too loose and you are back where you started, except now the dashboard is green and you have stopped looking. The second failure is worse than the first, because it comes with a false sense that the work is done. There are three more places the dashboard's reassurance runs thin: Its deeper checks are gated. The genuinely useful ones, database exposure, unprotected backend workflows, Swagger exposure, sit behind higher-priced plans. On a lower plan you get the headline, not the detail. Hidden is not hidden. A field or element marked hidden in the editor is still sent to the browser in the underlying data response. It is hidden from the eye, not from anyone reading the network traffic. A tool that checks your rules does not always check what actually ships. It cannot see your app from the outside. The dashboard reports on your configuration. It does not sit where an attacker sits and read your public endpoints back to you, which is the only view that tells you what is genuinely reachable rather than what should be. Why I looked at building a tool for this, and didn't. The honest part. When I started looking at Bubble, my first instinct was to build a scanner, the same shape as the plugin I built for Framer. I stopped for two reasons, and both are worth knowing if you are weighing a tool against a person. Bubble already owns this space. The Security Dashboard is theirs, it is free on paid plans, and they got there by acquiring the best independent tool that existed and folding it in. On top of that, at least one respected agency already gives away a free external scanner. The automated-scan job is done, three times over, and none of those tools can write your privacy rules for you. Because that is the part software cannot do. Reading endpoints and flagging missing rules is mechanical, and the platform has it covered. Deciding the correct rule for each data type, and then verifying from the outside that the fix actually closed the hole without breaking the app, is judgement about your specific product. That is a person who has done it before, not a scan. What a real Bubble audit finds. Put together, the findings that matter on a Bubble app look like this. Whole tables readable through the Data API because a privacy rule was never set. Fields marked sensitive or hidden that ship in the response regardless. Backend workflows configured to run without authentication, callable by anyone who finds the endpoint. API keys that ended up in client-side code where the browser, and everyone in it, can read them. Every one of these is invisible from inside a working app, and every one is findable from outside in an afternoon by someone who knows where to look. That last clause cuts both ways. Findable by Thunkle, and findable by anyone else. Check yours. Run Bubble's dashboard first. It is free and it is a real improvement, and for a lot of the exposure it is enough on its own. If it comes back with a list of missing privacy rules you are not sure how to close correctly, or you would rather know what your app actually exposes to the outside than what its settings say it should, that is the audit Thunkle do: Thunkle test your live app from where an attacker stands, tell you the right rule for each finding, and verify the fix held. You can request one here. If you're migrating, securing or building an AI-made app, Thunkle can help. Get a fixed quote in 24 hours.

Bubble.io payments tutorial: FumoPay API, signature and webhooks explained. Accepting payments inside a Bubble.io app is one of the most important milestones for any SaaS product, marketplace, or e-commerce tool. And if you are working with FumoPay as your payment gateway, getting the signature generation and webhook handling right is the key to making the entire integration work reliably. In this tutorial, Devcipator walk you through the complete FumoPay integration inside Bubble.io step by step. You will learn how to generate the required SHA 512 signature using custom JavaScript, create a payment using the FumoPay API, and handle the webhook response to confirm successful transactions inside your Bubble app. For the full API configuration and setup documentation, refer to this resource: https://docs.google.com/document/d/1av5piBEMCQeQko-wL_C9hDuDqRRxNw65pFMHc7o6vH8/edit?usp=sharing What is FumoPay? FumoPay is a payment gateway that allows businesses to accept online payments through a hosted checkout experience. Integrating it into a Bubble.io app requires generating a secure SHA 512 Base64 encoded signature, making a POST request to the FumoPay transaction endpoint, and handling the webhook callback that confirms whether a payment was successful. While this might sound complex at first, this tutorial breaks it down into clear, manageable steps that any Bubble developer can follow. Who is this tutorial for? This tutorial is ideal for: Bubble.io developers building SaaS applications that require payment functionality Teams building marketplaces or multi-vendor platforms on Bubble Developers creating custom checkout flows inside Bubble apps Anyone looking to integrate FumoPay into a no-code application A basic understanding of Bubble.io workflows and the API Connector is helpful but not required. Devcipator explain every part of the process clearly. Tools used in this tutorial. Understanding FumoPay signature requirements. Before writing any code or setting up any API calls, it is important to understand what FumoPay requires for authentication. FumoPay uses a SHA 512 Base64 encoded signature to verify that each payment request is legitimate and has not been tampered with. This signature must be generated by concatenating specific fields in a strict and exact order. The required concatenation format is: currency + description + profile key + external reference + signature date + secret key Any change in the order of these fields, or any formatting error, will cause the request to fail. The signature date must also be in UTC ISO format. Because Bubble.io does not natively support SHA 512 hashing, Devcipator use the Toolbox plugin to run custom JavaScript inside a Bubble workflow. Install the Toolbox plugin from the Bubble plugin marketplace if you have not already done so. This plugin gives you a "Run JavaScript" action inside your workflows and a "JavaScript to Bubble" element for passing values back into Bubble. Generate a UTC timestamp in ISO format for the signature date Concatenate the required fields in the exact order specified by FumoPay Hash the concatenated string using SHA 512 Convert the hash output to Base64 encoding Send the resulting signature and signature date back to Bubble using JavaScript to Bubble functions Make sure your secret key is handled securely and is never exposed in front-end code in a production environment. For production apps, this step should be moved to a backend workflow. Step 2: sending signature values back into Bubble. Place a JavaScript to Bubble element on your page and define two return values: one for the signature and one for the signature date. Your JavaScript code will call these elements to deliver the values back into your Bubble workflow. Once received in Bubble, these values can be stored in custom states or passed directly into the next step of your workflow. Step 3: creating the payment using the FumoPay API. With the signature and signature date ready, you can now create the payment by sending a POST request to the FumoPay transaction endpoint. Set up this API call inside the Bubble API Connector. The request body must include: Profile key Currency Description External reference Amount Redirect URL Signature Signature date The external reference is your internal order ID or transaction reference that you will use later to match the webhook response back to the correct order in your database. When the API call is successful, FumoPay returns a checkout URL. Your Bubble workflow then redirects the user to this hosted checkout page where they complete the payment. Step 4: handling the FumoPay webhook response. After the user completes or fails a payment on the FumoPay checkout page, FumoPay sends a webhook POST request to an endpoint you define. This webhook contains the transaction result and is how you confirm whether a payment was successful inside your Bubble app. To receive webhooks in Bubble, set up an API workflow endpoint in your Bubble app. This endpoint needs to be public and accessible from the internet. You can find your API workflow URL inside Bubble under Settings and then API. The webhook payload from FumoPay includes: Transaction ID External reference Payment result Status Inside your Bubble API workflow, use the external reference value to look up the original order in your database. If the result text is "paid," update the transaction record in your database to mark it as successful and trigger any follow-up actions such as sending a confirmation email or activating a subscription. Important tips for production environments. Always use UTC time format for the signature date. Any deviation will cause the signature validation to fail. Never change the order of the fields used in the signature concatenation. FumoPay validates the signature based on a strict field order. Keep your secret key secure. In a production environment, move the signature generation logic to a backend workflow so the secret key is never exposed in front-end JavaScript. Make sure your webhook endpoint is public and accessible. FumoPay cannot deliver webhook events to a URL that requires authentication or is behind a firewall. Test your integration thoroughly in the FumoPay development environment before going live with real transactions. Watch the full video tutorial. Every step covered in this guide is demonstrated in full detail in its YouTube tutorial:

Every launch, every country, every minute: Bubble Is Global V2. May 2026 rankings, live launch pulses, and the first mobile-app view of the map - V2 of bubble.io/global is here. Just now, somewhere in the world, a Bubble app went live. Maybe it's a hospitality platform automating hotel operations in Philadelphia, or a financial planning tool helping an advisor in São Paulo convert a new client. None of these builders know each other and none of them coordinated. But head to bubble.io/global today and you'll see their launch registering on the map, a pulse of activity spreading across every continent - and now for the first time, that includes native mobile apps. That's the next evolution of Bubble Is Global. What's new in V2. When Bubble Group, Inc. first launched Bubble Is Global, Bubble Group, Inc. introduced it region by region - Europe, then North America, then South America, then the rest of the world - until every continent was on the map. It was a celebration of how far the Bubble community had grown. V2 keeps that spirit and makes the map something you come back to, with a few improvements: * Live launch feed: Every time a Bubble app launches, it registers on the map in near real time (only a ~2-minute delay). * Last 30 day rankings: Each country's top apps are ranked by traffic from the last 30 days and refresh every day, so the map stays current as apps grow. * All / Web / Mobile filter: Filter the map by platform and see top builders for web, native mobile, or both, by country. * Builder profiles: Featured builders now have richer profiles with logos, founder stories, and app screenshots. If your app is on the map and your profile is sparse, this is your moment to fill it in. Mobile is here and worth celebrating. Bubble's native mobile apps are on the global map for the first time. Toggle on the mobile filter and you'll see which builders are shipping native iOS and Android apps, ranked by country. It's a small toggle in the UI and a significant moment for a community that's been building quietly. Native mobile on Bubble has been production-ready for a while now, with apps built in weeks using the same backend and database as their web counterparts. V2 gives those builders their first-class view of the map. If you're building for mobile and your app isn't on the map yet, make sure you're logged in and then head to bubble.io/global and submit it through the popup - rankings refresh every day, so the next slot in your country could be yours. Builders on the map. The map works because of the people building on it. This month Bubble Group, Inc. is spotlighting five apps spanning North America, South America, Europe, Africa, and the Middle East and North Africa (MENA) region - a mix of consumer and B2B, all real businesses with real users. SuiteOp - united states. #5 in the US Jean-Emmanuel Losi and Simon Seroussi started building internal tools on Bubble for their short-term rental company in Philadelphia. By 2024, those tools had grown into something worth selling. SuiteOp is now a vertical SaaS platform covering the full hospitality operations cycle, from smart lock control and thermostat automation to housekeeping scheduling, guest portals, and AI-powered photo verification for task completion. The team also built a native mobile app in just two months using Bubble's mobile editor, which field staff use daily. "Being able to use the same backend workflows, the same database - those things were really big time savers," Jean-Emmanuel says. SuiteOp has raised $3 million in seed funding, reached $700,000 in ARR, and serves more than 100 organizations with up to 30,000 daily guest users. Dashplan - Brazil. #3 in Brazil Dashplan helps financial advisors take a 360° view of their clients, consolidating financial data, running real-time retirement projections, automating budgeting, and managing the full client relationship in one place. Advisors using the platform collect up to 400 data points in a first meeting, prepare quotes 92% faster, and have seen revenue increase by more than 14% after adopting the 360° approach. The app is available on desktop and mobile across more than 20 countries. My AskAI - united kingdom. #2 in the UK Alex Rainey spent years as a technology consultant but couldn't build software himself. When he and co-founder Mike Heap discovered Bubble, that changed. They pivoted their product and rebuilt the new version in six weeks. My AskAI trains on a company's website and internal documentation to create a custom AI support agent. When a conversation exceeds what the agent can handle, it hands off to a human. The tool integrates with Zendesk, Intercom, and HubSpot, generates $25,000 in monthly recurring revenue, and supports more than 40,000 registered users - with a team of two. "There's no way I'd ever start a project in pure coding ever again," Alex says. Recruitera - Egypt. #1 in Egypt Recruitera is an applicant tracking system built for the MENA region, backed by a decade of experience in talent and employment. It helps hiring teams source candidates, automate repetitive tasks, and track applicants through a visual pipeline from first application to final decision. The platform integrates with Google Jobs, LinkedIn, Outlook, and regional job boards like WUZZUF and Forasna, and claims to reduce manual hiring work by up to 64% and cut cost-per-hire by 35%. Cuure - France. #7 in France Founded in Paris in 2019 by Jules Marcilhacy and Hugo Facchin, Cuure creates personalized, science-backed daily supplement routines delivered in custom sachets. Every formula is developed with a scientific committee, with the goal of making effective, personalized health accessible to more people. The team's goal is to raise the standards of the industry and make effective, personalized health accessible to more people. How to get your app on the map. The map refreshes every day, which means there's always a next opportunity. Head to bubble.io/global and you can update your app's profile If your app is already on the map, fill in your profile - logo, story, a few screenshots. Bubble Group, Inc.'ll publish it within three business days. If your app isn't on the map yet, submit it. Rankings refresh daily, so the next country slot could be yours soon. If you just want to look around, switch between web and mobile apps and watch the launch feed pulse. And wherever you land, share what you find. Whether it's your own app, a builder in your country, or something that caught your eye from across the world - use #BubbleIsGlobal on socials to support what's being built. What's ahead for the global map. Builder milestones, ongoing app updates, and a community feed are coming as follow-ups to today's launch for more ways to stay connected to what the Bubble community is building. For now, the map is alive. Come see what's on it. Start building for free Build for as long as you want on the Free plan. Only upgrade when you're ready to launch.