22 years in recruiting, zero code background. Built a patent-pending AI recruiting marketplace on Bubble. Here are the mistakes and the fixes.

Showcase
1

I’m a recruiter, not a developer. 22 years on agency desks. In under a year I built IronBase (ironbase.tech), a split fee recruiting marketplace with an AI candidate grading engine that now has a provisional patent filed with the USPTO. It won Best Use of Bubble AI at the hackathon hosted by Anthropic, Bubble, and Contra.

What’s running in production: two Bubble apps. The main marketplace (jobs, split fee tracking, client dashboards, Stripe billing) and a separate sourcing app that launches from the main app with a token handoff. Around them: Cloudflare Workers serving the public site, an XML job feed, and branded apply pages with AI resume grading, plus SendGrid, SignalHire’s API for an 850M profile database, OpenAI for grading, and Claude for outreach drafting.

The mistakes, in case they save someone the weeks they cost me:

  1. I built the entire app non responsive. Classic new builder move: drag elements onto the 1200px canvas, fixed widths, fixed heights, ship it. Then real users showed up on real screens. My patch was a CSS zoom hack in the page headers that shrank the whole app like a photocopy at different breakpoints. It mostly worked on desktops and always broke on iPhone. A 390px screen scaling a 1200px canvas is going to be tiny no matter what you do. The real fix was migrating every page to the responsive engine with proper Column and Row containers and min max widths, while the live app kept the hack until cutover day. Build responsive from day one. There is no shortcut that survives contact with phones.
  2. Cross app token handoff. Bubble canonicalizes /index to / on navigation, which silently drops URL parameters. My app to app login handoff died with no error anywhere. A dedicated launch page on its own URL fixed it.
  3. Webhook signature verification. Bubble reserializes incoming JSON before you can touch it, so raw byte HMAC verification is impossible in native Bubble. I verify through an external proxy function instead.
  4. FloatingGroups cannot render above popup overlays in the new responsive engine, no matter what z index you set. I rebuilt my toast notifications anchored to the viewport bottom to live outside the conflict entirely.
  5. API Connector body parameters use angle brackets, not square brackets. Square brackets only work in URLs and headers. The hint text says this. Nobody reads hint text until day three of debugging.

What I’d tell any non technical founder considering Bubble: the ceiling is much higher than people say. The patent pending part of my platform, a multi source grading engine, runs on Bubble workflows and API calls. You do not need to leave the platform to build something defensible.

Happy to answer anything about the build.

2

Welcome to the Bubble Community! :tada:

That’s why just one coaching session pays for itself.

Here are some other tips of common mistakes for new developers.

  1. Check and harden your privacy rules. If anything says ‘Public’, that really means EVERYONE can see that data.
  2. Secure your backend workflows. Don’t have them open to the public unless that is what you need to do and it’s secure. Use a token instead to secure it.
  3. Don’t expose API keys on the front end of your app.
  4. Use the Bubble security dashboard
  5. Popups are not a security wall. They can easily be removed.

There are many more, but I feel these are the important security ones that most people miss.

Hope that helps. :blush:

3

Really cool!

Why did you build 2 apps not all on one?

What’s your average token cost of ‘grading’ the applications? Does it just assess based on resume?

Where did you source the 850M candidates so quickly from?

4

Hi Jason!

5

Thanks!

Why 2 apps: Sniper started life as a hackathon build (it won Best Use of Bubble AI at the Anthropic x Bubble hackathon) so it was born standalone, and honestly keeping it separate has been a feature, not a compromise. Different release cadence, workload isolation so a heavy AI sourcing mission never slows the marketplace, and cleaner risk containment. The two apps talk through a one-time token handoff, so users click one button in the marketplace and land in Sniper logged in with credits synced. Feels like one product, runs like two.

Grading cost: roughly a penny or two per grade. It’s not just the resume, the grader takes the full job description plus the resume and work history and scores against the actual requirements, with a second structured pass that produces the breakdown recruiters see. Whole AI bill across grading, extraction, and Boolean generation runs a few dollars a day at current volume.

The 850M: that’s a licensed third party talent data provider integrated by API, not something we scraped or built ourselves. The product is what we do on top of it: search UX, AI grading against live jobs, and contact reveals with credit gating.