Hi, apparently I can’t hide (or put behind auth) the meta api i.e /api/1.1/meta
It exposes details of things and workflows.
I think this is so not secure.
Is there a way to restrict it?
3 Likes
+1 here… is there anyway to restrict access to it? (with api token?)
1 Like
An interesting question, I assumed checking the box “Hide swagger documentation” but apparently that doesn’t do it.
@sam.morgan
Maybe I’m a dummy but what do you mean with your original question? It’s kind of vague and hence why no one responded.
Add /api/1.1/meta to the end of your app domain it exposes every workflow name and API endpoint, it’s different from the swagger documentation tho
2 Likes
For example here’s the Bubble.io entire data structure: https://bubble.io/api/1.1/meta
And all the juicy yes/no fields for if a User is an official Bubble employee, etc.
2 Likes
Interesting 
2 Likes
@bubble please fix this asap
+1 also
1 Like
That’s kinda crazy, but made me feel a lot more comfortable about my app data security.
At a high level, being able to get every Bubble user’s full name and profile photo feels like a bit of a privacy breach, but it’s kind of already available through the app anyway.