# Is my Bubble app hacked? **URL:** \ **Category:** Questions\ **Created:** [April 7, 2017, 10:40pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281 "2017-04-07T22:40:46Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![sorensong](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sorensong/32/64457_2.png) [@sorensong](https://forum.bubble.io/u/sorensong)\ **Post date:** [April 7, 2017, 10:40pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/1 "2017-04-07T22:40:47Z")
So I’ve been noticing some VERY strange activity on my Bubble site. 1. Random db entries are created in a section (table) that is restricted 2. Very specific db entries have been deleted, but that should also be restricted. Both have happened several times and both are restricted to certain types of users. No matter how much I try, I just cannot seem to make sense of it. Has anyone else experienced anything like this? ---
**Author:** ![romanmg](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/romanmg/32/237672_2.png) [@romanmg](https://forum.bubble.io/u/romanmg)\ **Post date:** [April 8, 2017, 12:41am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/2 "2017-04-08T00:41:38Z")
Have you looked at your logs to narrow down time stamps and/or looked at the “Created By” field to see which user created the new entries? Do you have anyone added as a collaborator on the app? Is it public/private? ---
**Author:** ![sorensong](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sorensong/32/64457_2.png) [@sorensong](https://forum.bubble.io/u/sorensong)\ **Post date:** [April 8, 2017, 6:27am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/3 "2017-04-08T06:27:12Z")
Yeah, I’ve looked at the ‘Created By’ field to try and narrow it down. They’re seemingly random users who’ve created the entries. The thing is, there is a field that should auto-populate with certain values that are not being filled in. What’s more concerning is the loss of data. I’m not sure what clues I can use to see who is deleting data. I’m not on the professional plan, so I don’t think I have any logs to sift through? Ugh. (Thanks for your reply, though) ---
**Author:** ![JonL](https://avatars.discourse-cdn.com/v4/letter/j/e5b9ba/32.png) [@JonL](https://forum.bubble.io/u/JonL)\ **Post date:** [April 8, 2017, 8:23am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/4 "2017-04-08T08:23:08Z")
Log reporting should be included In every package in my opinion. Exactly because of this. At least simple reporting. Maybe not huge dashboards or with great detail, but any paying owner should be able to at least know what is happening in his app. Or maybe as priced add-on. But at least have the option 🙂 ---
**Author:** ![raymond](https://avatars.discourse-cdn.com/v4/letter/r/c57346/32.png) [@raymond](https://forum.bubble.io/u/raymond)\ **Post date:** [April 8, 2017, 11:16am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/5 "2017-04-08T11:16:01Z")
I’ve seen quite a few Bubble apps that’s very easy to hack so it’s quite possible your app have been hacked. ---
**Author:** ![ashley.benson.tait](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/ashley.benson.tait/32/13292_2.png) [@ashley.benson.tait](https://forum.bubble.io/u/ashley.benson.tait)\ **Post date:** [April 8, 2017, 12:08pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/6 "2017-04-08T12:08:18Z")
Is the app that’s been hacked public or private? ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [April 8, 2017, 2:22pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/7 "2017-04-08T14:22:39Z")
That is indeed the right question. Was the app protected in run mode by a password or not? If it isn’t, anyone can find the URL and use the app. It’s not a hack, it is that the internet is an open, public space. If you want to make sure that doesn’t happen, you should add a password in run mode and of course make the app editing private as well. ---
**Author:** ![john\_reed74](https://avatars.discourse-cdn.com/v4/letter/j/53a042/32.png) [@john\_reed74](https://forum.bubble.io/u/john_reed74)\ **Post date:** [April 8, 2017, 4:47pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/8 "2017-04-08T16:47:22Z")
Emmanuel can you elaborate and/or point to instruction on how to “add a password in run mode”. Thanks ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [April 8, 2017, 4:58pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/9 "2017-04-08T16:58:07Z")
This covers it [https://manual.bubble.is/application-settings/private-and-public-apps.html](https://manual.bubble.is/application-settings/private-and-public-apps.html) ---
**Author:** ![john\_reed74](https://avatars.discourse-cdn.com/v4/letter/j/53a042/32.png) [@john\_reed74](https://forum.bubble.io/u/john_reed74)\ **Post date:** [April 9, 2017, 6:20pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/10 "2017-04-09T18:20:01Z")
Thank you 🙂 ---
**Author:** ![scriptschool](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@scriptschool](https://forum.bubble.io/u/scriptschool)\ **Post date:** [April 10, 2017, 11:15am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/11 "2017-04-10T11:15:52Z")
Could you please enable a password setting _for each page_? I would like to set a pwd for admin pages, and not the entire app. I’m sure others would find this useful too. Thanks, P ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [April 10, 2017, 1:13pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/12 "2017-04-10T13:13:10Z")
You can do this by setting a page load event and redirect users that shouldn’t access some pages. That offers more flexibility to the app builder, and performance wise, checking this for each page would not be efficient. ---
**Author:** ![scriptschool](https://avatars.discourse-cdn.com/v4/letter/s/8dc957/32.png) [@scriptschool](https://forum.bubble.io/u/scriptschool)\ **Post date:** [April 10, 2017, 1:45pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/13 "2017-04-10T13:45:03Z")
Hi Emmanuel, I’ve done this but was testing it recently to see if it is strong enough. It is not - it is extremely easy to get around. Rather than document how here, I will reach out to support and let you know (bug report). Regardless, far more peace of mind would be available if you just let users set this per page. Thanks, P ---
**Author:** ![proust007](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@proust007](https://forum.bubble.io/u/proust007)\ **Post date:** [April 10, 2017, 7:42pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/14 "2017-04-10T19:42:38Z")
> [@scriptschool](#): > > it is extremely easy to get around. uhhhhh, that doesn’t sound reassuring. ---
**Author:** ![mishav](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/mishav/32/6420_2.png) [@mishav](https://forum.bubble.io/u/mishav)\ **Post date:** [April 11, 2017, 1:28am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/15 "2017-04-11T01:28:38Z")
> [@scriptschool](#): > > it is extremely easy to get around What I do for admin pages is assume anyone can get access to them, so in addition to the redirect: - All controls are in a group that becomes visible if user has admin access. - Data searches have a filter on the user having admin access. - Workflows have conditions on the user having admin access. - Data privacy settings for user role/admin. ---
**Author:** ![Scott](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/scott/32/565_2.png) [@Scott](https://forum.bubble.io/u/Scott)\ **Post date:** [April 11, 2017, 1:53am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/16 "2017-04-11T01:53:07Z")
> [@mishav](#): > > What I do for admin pages is assume anyone can get access to them, so in addition to the redirect: > > All controls are in a group that becomes visible if user has admin access. > Data searches have a filter on the user having admin access. > Workflows have conditions on the user having admin access. > Data privacy settings for user role/admin. These are excellent and **mandatory** practices every single Bubble developer needs to implement. If you aren’t doing these things, you are compromising your app and your users’ data. While the Bubble team can make some things easier, it is ultimately up to the developer to build out robust security measures. ---
**Author:** ![sorensong](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sorensong/32/64457_2.png) [@sorensong](https://forum.bubble.io/u/sorensong)\ **Post date:** [April 14, 2017, 1:53pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/17 "2017-04-14T13:53:44Z")
Welp, all of my rows of data have been deleted and replaced with ‘hacked’ rows. Here is what I had on April 8th (94 rows): ![](https://us1.discourse-cdn.com/bubble/original/2X/5/51445abbdd38cfdb2a0e807e4c2024eea79cb6ac.JPG) And now this is what I have (April 14th) ![](https://us1.discourse-cdn.com/bubble/original/2X/9/942d2bdb56c433fa74cbbce3e2e5dccafbe31bbe.png) I only have one workflow that performs a ‘delete’ operation and that page is (should be) only accessible by specific users. This is, umm… bad. Hopefully I can restore the data, but more importantly, hopefully I can figure out how this is being done and who is doing this. ---
**Author:** ![sorensong](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sorensong/32/64457_2.png) [@sorensong](https://forum.bubble.io/u/sorensong)\ **Post date:** [April 14, 2017, 5:20pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/18 "2017-04-14T17:20:20Z")
Could you show me what you’ve found? Or take a look at my app to see if what I’m doing is not secure? ---
**Author:** ![emmanuel](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/emmanuel/32/27657_2.png) [@emmanuel](https://forum.bubble.io/u/emmanuel)\ **Post date:** [April 15, 2017, 7:21pm UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/19 "2017-04-15T19:21:11Z")
After looking the app it turns out there was some workflows that could delete entries that were not protected by a condition on the user. The lesson is: if you have some pages that aren’t protected with conditions, users can do a bunch of stuff. Now the good news is that Bubble has database backups. ---
**Author:** ![florent.bocquelet](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/florent.bocquelet/32/11409_2.png) [@florent.bocquelet](https://forum.bubble.io/u/florent.bocquelet)\ **Post date:** [April 18, 2017, 7:58am UTC](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281/20 "2017-04-18T07:58:35Z")
Regarding this, when we define some custom action in the workflow editor, do we need to put conditions on the custom action itself, or only in the steps/workflows that call it ? Just as the “Performance Q&A Guide” thread, it would be interesting to create a “Security Q&A Guide” thread 🙂 [Next page](https://forum.bubble.io/t/is-my-bubble-app-hacked/12281.md?page=2)