🎉 Introducing the most advanced security platform for Bubble for free (Bubble App Audit)

[QIRO]

This is an incredible tool, thank you!

[georgecollier]

@ramzizi

report said it was leaking API keys, but it just turned out to be test Stripe user accounts.

Just shipped an improvement here that should reduce this false positive

@QIRO

This is an incredible tool, thank you!

Thank you so much! Hope you find it useful.

In case anyone’s curious, the short term roadmap (before the end of the year) includes:

• automated privacy rule testing for multiple user types (the data explorer allows this but you need to look manually)
• more accurate backend workflow analysis with editor access, that takes into account the contents of backend workflows
• a handful of other minor checks that nobody else in the ecosystem checks for
• the fastest and most user friendly logs interface + backup in the ecosystem

I’m open to shifting based on feedback to see what would be most useful for people here!

[senecadatabase]

Thanks for this George.

As someone else said, Bubble needs to hire you

[randomanon]

@senecadatabase

As someone else said, Bubble needs to hire you

Yes, but first they need to not shut down his app.

Acceptable Use | Bubble

2. Things You May Not Do:

A. You may not make unauthorized copies, modify, adapt, translate, reverse engineer, disassemble, decompile or create any derivative works of the Platform or any content included therein, including any files, documents, postings, or documentation provided by Bubble or any other user of the Bubble Platform (or any portion thereof).

B. You may not determine or attempt to determine any source code, algorithms, methods or techniques embodied by the Platform.

and

E. You may not develop, support or use software, devices, scripts, robots or any other means or processes (including crawlers, browser plugins and add-ons or any other technology) to scrape the Platform or otherwise copy profiles, request for proposal descriptions, and any other data from the Platform.

and perhaps most importantly:

L. You may not use Bubble to violate the security or integrity of any network, computer or communications system, software application, or network or computing device (each, a “System”). Prohibited activities include, but are not limited to:

1. Unauthorized Access. Accessing or using any System without permission, including attempting to probe, scan, or test the vulnerability of a System or to breach any security or authentication measures used by a System;

Let me repeat that:

1. Unauthorized Access. Accessing or using any System without permission, including attempting to probe, scan, or test the vulnerability of a System or to breach any security or authentication measures used by a System;

I think he might be able to get hired by Bubble like he is intending to, but the first step would be to comply with their policies and go from plainly illegal (the app in the current state) to just slightly illegal (the app + requiring permission to scan).

[georgecollier]

Bubble already knows about NQU Secure and is happy for third party security tools to be in the ecosystem

To quote them, their main point of sensitivity regarding third party security tools is requiring ownership verification, which we have done. They said that the acquisition of Flusk was not meant to suppress third party security offering, but be an official option. Successful ecosystems like AWS have a mixture of in-house and third party offerings, and Bubble can too as that’s healthy all around.

They’re smart people and know that security platform-wide can improve, and are taking steps to let that happen.

Thanks anyway for your feedback.

[ed19]

This looks the part @georgecollier! I got quite frustrated using Flusk’s UI so am glad of another option, not so glad of just how many errors it’s found haha. To quote the great Des’ree… “Life, oh life”.

Suppose I’d better get clicking!

[georgecollier]

@ed19

I got quite frustrated using Flusk’s UI so am glad of another option, not so glad of just how many errors it’s found haha.

Yeah so this is one of the pain points I identified (though I have no doubt @vnihoul77 @wesleywsls recognise this and will already have plans to improve it) - where it kind of feels slow / clunky. I tried to make it dead simple to use so you can easily scan through issues and prioritise what matters to you.

[ed19]

It’s much appreciated Had seen you posting about your backup tool previously but not actually looked into it too much, and that seems to now be incorporated too. Very robust, you’ve done a real service for everybody here.

[fede.bubble]

Hi everyone, I’m stopping by to share more context related to concerns around this tool:
Bubble is definitely aware of what George is doing. We’re excited to see third-party tools like this popping up, and it’s awesome to have folks contributing to making the ecosystem better for everyone!
On the ToS concerns, don’t worry—Bubble’s got it covered. Let’s keep the conversation constructive and focus on how we can all benefit from these innovations.

[lindsay_knowcode]

Oh @fede.bubble The voice of reason

Anything that moves Bubble up the dial on security & maturity is good for everyone.

[randomanon]

@fede.bubble

On the ToS concerns, don’t worry—Bubble’s got it covered.

Hey Fede thank you for chiming in. Just to be clear, when you say this do you mean:

1. Bubble is aware of this and will be recommending verification before allowing a summary view

or

2. Bubble is aware of this and will be making a one-time exception for their own ToS

[georgecollier]

It’s Bubble’s business what they choose to do but they won’t endorse/permit anything explicitly for obvious reasons.

Don’t worry about it. Remember, if they want to shut it down, my app is built on Bubble, so the off switch is right in front of them and they’d be well within their right to hit it.

As Fede says, focus on the benefits and if Bubble has problems you know they’ll come to me about it!

——
In other news, today I’m adding a check to page redirects - not only will we check the visible contents of redirected page, but we’ll check invisible elements on a page. Invisible elements can be made visible, so well simulate that when determining if a page is secure.

[randomanon]

@georgecollier

they won’t endorse/permit anything explicitly for obvious reasons

@georgecollier

they’d be well within their right to hit it

What do you mean by these statements?

[mikeloc]

I haven’t posted in quite some time, and from the looks of this thread, I haven’t missed a thing because everything, including literally the same interaction going on here, has been done before.

@randomanon, if it helps (spoiler alert: I’m guessing it won’t), you can stop pulling at that particular thread. When Flusk did their thing, I communicated directly with Josh himself, I pointed out that what they were doing was likely against Bubble’s own terms of service, and in the end, as I predicted (yeah, tooting my own horn there, but come on, that was a pretty impressive call, if I do say so myself), Flusk got acquired.

Now, to be clear, George is definitely not Flusk, and if you read the linked thread, you will probably get what I mean. That being said, and to try to add some value here, I still believe that nobody should be able to scan an app they don’t own, regardless of what is shown to them (i.e., only a summary) as a result of the scan. @georgecollier, just another opinion for you to consider.

Anyway, that’s all I got. We now return you to history repeating itself, sans the incessant ramblings of, well, me.

Best…
Mike

[rico.trevisan]

@mikeloc

the incessant ramblings of, well, me.

That’s what makes the forum great.

[georgecollier]

@mikeloc

Anyway, that’s all I got. We now return you to your regularly-scheduled forum, sans the incessant ramblings of, well, me.

Welcome back! From the ashes, he rises…

@georgecollier

In other news, today I’m adding a check to page redirects - not only will we check the visible contents of redirected page, but we’ll check invisible elements on a page. Invisible elements can be made visible, so well simulate that when determining if a page is secure.

This has been added! In the near future, I may allow you to view screenshots of pages in your app with all of the elements forced visible so that you can see how an attacker might use hidden buttons in places like admin panels and why adding conditions to workflows is improtant.

[lindsay_knowcode]

We miss you Mike

[tylerboodman]

Hi Mike

[georgecollier]

The Visibility Scanner will shortly allow you to view any of your pages as a hacker could - with everything visible. An attacker could click any button on your page, and it’ll only be safe if protected by a workflow condition.

The purpose of this tool is to make people more likely to understand that invisible on page load does not protect your page, and conditions on workflow events are necessary.

Check out the hidden sections of the NQU Secure homepage:

[randomanon]

@mikeloc

Now, to be clear, George is definitely not Flusk

I think this is worse because you can’t even opt out of your information being sent to third party providers like OpenAI, OpenRouter, etc. So you’re essentially streaming proprietary data you don’t have the rights to to another provider, which breaks that provider’s ToS as well. There are so many layers of illegality here, it honestly boggles the mind. Really concerning if @josh and @emmanuel are aware of the current implementation and are totally OK with it.

@mikeloc

I still believe that nobody should be able to scan an app they don’t own, regardless of what is shown to them (i.e., only a summary) as a result of the scan.

Good to see there is at least one other sane person on this forum. And of course it would be one of the legendary OGs.

Again, two simple fixes:

• No summary before verification
• A setting that toggles LLM-based analysis which is turned off by default (when scanning without verification)

@mikeloc

We now return you to history repeating itself, sans the incessant ramblings of, well, me.

They’re good ramblings though!