# How Secure Is This Idea? **URL:** \ **Category:** Database\ **Created:** [February 29, 2024, 8:51pm UTC](https://forum.bubble.io/t/how-secure-is-this-idea/310019 "2024-02-29T20:51:30Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![georgecollier](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/georgecollier/32/182327_2.png) [@georgecollier](https://forum.bubble.io/u/georgecollier)\ **Post date:** [February 29, 2024, 9:34pm UTC](https://forum.bubble.io/t/how-secure-is-this-idea/310019/2 "2024-02-29T21:34:12Z")
> [@Bits of your Bubble app you might not know are public](https://forum.bubble.io/t/bits-of-your-bubble-app-you-might-not-know-are-public/296682/1): > > # Pages > > Every page is visible (even if it’s not ‘accessible’ or a sitemap isn’t expose). You can’t just make an unsecured page called admin13097193805715 and hope nobody finds it because you don’t expose the sitemap. Bubble sure has a lot of them! > > ![CleanShot 2023-12-07 at 11.56.35@2x](https://us1.discourse-cdn.com/bubble/original/3X/2/b/2bd288ec69291909e5112238dddf8ae34c9c6443.png) 1. Your page can be found 2. A popup can just be hidden by the user, it’s not secure. You need an option set called ‘User Role’. This should, depending on your app, just contain Standard and Admin. Set your admin user’s User Role to Admin. Configure privacy rules that allow the data to be seen Only when Current User’s User Role is Admin. On the admin page, have a page load workflow with a condition that takes the user away when their User Role \<\> Admin. Privacy rules stop the user’s data being exposed to people who shouldn’t have it. The page load workflow stops them being able to see the admin panel (though it is wise to make sure the admin panel UI is only visible when Current User’s User Role = Admin, as a user can often cancel the redirect) --- _[View the full topic](https://forum.bubble.io/t/how-secure-is-this-idea/310019)._