The standard privacy rule approach is not robust
Most developers assume that a standard form privacy rule like “This Team’s Company is Current User’s Company” will effectively restrict access to only users within the same company. However, that assumption overlooks a common edge case that leads to data leaks.
After auditing many, many apps, after misconfigured/no privacy rules, this is the most common cause of data leaks for apps where the developer has attempted to set up privacy rules correctly…
Understanding the issue
- When a privacy rule’s reference field (like Company) is empty, Bubble evaluates it as matching an empty value
- For logged-out users, their Company field is naturally empty
- Therefore, if you have a Team whose Company field becomes empty (e.g., after company deletion), it will suddenly become visible to all logged out users!
Example case
Consider a team collaboration app where teams belong to companies. You might have a privacy rule:
This Team's Company is Current User's Company
If you delete a company but forget to clean up its associated teams:
- The teams now have an empty Company field
- These teams become publicly accessible
- Any user (even logged out) can now view these “orphaned” teams
How to Fix It
The solution is straightforward - always add an “is not empty” condition to these types of privacy rules:
This Team's Company is Current User's Company
AND
This Team's Company is not empty
This ensures that items with empty reference fields remain private rather than becoming public by default.
How to Test Privacy Rules
To verify your application’s vulnerability to this issue:
- Create a test page with a repeating group for each data type in your app
- Set each repeating group to
Do a search for Datatype - Leave the constraint field empty to search all records
- Add a text element for each field in that data type to display that field’s data
- Steps to test:
- Log out of your application or log in as the user you want to test
- Visit the test page
- Any data visible in the repeating groups that should not be, represents a privacy vulnerability
Testing automatically
I think the method above is a pain in the ass, so I’ve developed a tool to test this auto-magically.
You can preset each user type:
Then, just configure the search:
Search and explore the data accessible to that user:
If you’d like to try it out, you can sign up for the waitlist @ https://secure.notquiteunicorns.xyz. It’s entirely free. I think this feature makes it the most powerful security analysis tool in the ecosystem (it is essentially a privacy rule debugger), and I hope Bubble would integrate something like this directly into the editor.
Dude