A client wrote to us today to say that we had a big data leak issue and that he could get access to our products for free, as well as seeing exposed personal data! Obviously this was extremely concerning.
When i investigated, I am shocked to see various pieces of information in the ‘search’ js (responses in the network tab) that simply shouldn’t be there. Not only are privacy rules set up correctly, but some of those fields should not even exist! They may have existed once in the past.
How is this possible and what can I do to fix it? I’ve performed a ‘optimise app’ many times.
Furthermore, does this mean that for the last X years i’ve been massively overcharged for search WU costs as it’s been returning heavy searches filled with data it shouldn’t have even been returning??
Many thanks
1 Like
In order to delete fields you need to:
- Delete all data (either using a backend workflow or the editor) from that field
- Set privacy rules so that no one can access the field (optional, but I do this to be safe)
- Delete the field
- Optimize app
If you mess up the order of these, then you need to contact support. This was only recently documented in the manual after a big thread on these forums.
1 Like
Ok thanks. I’ve found the article in the documentation and have contacted support as how to best clean up this mess now. Would be grateful if you could share the previous forum link too if you can recall what it was. Cheers
I managed to fix these leaks by following the steps discussed in this other thread:
https://forum.bubble.io/t/bubble-doesnt-delete-data-in-fields-that-are-deleted/354406/6
The process, as described there, is to recreate the old deleted fields (the ones still showing data in searches), then run a workflow to clear out all the data, and finally delete those fields again.
One thing that tripped me up at first was how the field names appear differently in the browser inspector. For example, my old field showed as song_zip_file, so I recreated it exactly like that, and it didn’t work. The correct old name was actually just song_zip – Bubble had added the file part automatically (_text _date etc). So keep that in mind when recreating the old fields.
In the end, this stopped the unwanted data from appearing in searches for that datatype. Thank goodness. My concern now is that other datatypes might also be leaking ‘old’ data, so I’ll need to go through and test everything manually. (@georgecollier Does Buildprint check for this particular issue?)
I’d hate to think how many other users have deleted fields in the past and now unknowingly have private or critical data being exposed. This feels like a serious issue that deserves more attention tbh.
Cheers
Dale
3 Likes
