[New Security Plugin 🛡 ] nocode:nohack - Hack your own Bubble app (and fix it!) + Free Security ebook

[b.demontecler]

Hey Bubblers ! Today we are really excited to introduce a Security Plugin to the Bubble Community . For 3 years I’ve been bubbling for several apps and i learnt a lot about Bubble Security (thanks to tinkso ex-ideable and their tool apicheck). But today I saw a lot of vulnerabilities in the majority of Bubble apps! It’s so important for the no-code future to take security seriously and keep it confident.

That’s why we worked for several months with my co-founder Kevin on a Security Plugin to let you check your own app and see if there are any security breaches (Token/Secret/Bearer, webhooks, Users emails, Business Data and more…).

We check Data API, Plugin & API Connector, Option Sets content, Pages List, Database Default Value, Static Content (premium) and Privacy Rules (premium).

How it’s works:

1/ Enter the URL of your Bubble app on https://nocodenohack.com and authenticate it by adding the nocode:nohack plugin.

2/ Wait for the test end (less than 10min)

3/ Upgrade if you want to see more vulnerabilities (30 days money back)

4/ Review vulnerabilities (ignore all false-positive) and learn how to fix them

5/ If you need help, contact us by using our live chat

After your sign up, you will receive our ebook “Guide to Secure your Bubble app”

We are adding more and more features to our security engine to help you to secure your Bubble app better and better. Contact us if you have some ideas

ps : yes, it’s a Bubble app too !

[charles4]

Congrats @b.demontecler ! I am impressed by what you did about this important topic !

Such a great idea and well designed too

Charles

[vincent56]

Well done Benoit! Great to see you’ve come so far!

[thibault.marty]

Great Plugin !

Security is becoming more and more essential on Bubble and this application is a must have

[wesleywsls]

Thank you very much for innovating in this way. Very useful.

This topic is going to become more and more essential in the coming months/years and we need solutions like yours to keep our data safe.

Thank you very much

[danibrario]

Congratulations! Already signed up and thank you for the PDF. Will read carefully. Security rules is a TOP priority in every app. Specially for the Bubble ecosystem. Great contribution! Thank you!

[antoine3]

Great job !!

[chrismilleratx]

Fantastic! Thank you, and congratulations!

[lindsay_knowcode]

Great tool. I tried to create the same thing myself but gave up, so I know how much effort this took. Really well done.

[robin.f]

You nailed it ! The one and only plugin to secure your bubble apps, i definitly recommand it.

[b.demontecler]

Hi all !
We are very happy to announce a major update to our security tool nocode:nohack! Thanks a lot to all your feedbacks ! We have worked a lot on them last 4 weeks

New features :

• Security Report Synthesis
  

  

• Data API : 3 last things checked for each call directly
  

  

• Database Structure and Option Set Detection at field level
  

  

• Pages list with a lock if the page have a redirection rule
  

  

• Team Management for Agencies with several access levels (Guest, Member, Manager, Owner) + Agency can define it’s own roles permissions.
  

  

• Now all safe elements are kept visible but on the bottom of the list, new menu to mark as safe
  

• New menu on the left to have the categories and not the severities to have a better understanding.

• More accurate detection engine to define the severity according to whether it finds a token, a customer email, an internal email, etc …

New Pricing :
All the test features are now free except the Privacy Rules Check.

• Free (Data API Test, Workflow API Test, Plugin & API Connector, Option Sets content, Private Pages List, Database Default Value, Static Content)

• Paid, from 39€/month (Privacy Rules Check + Test Scheduling + Team Management for Agency).

Build safely !

[michitomo]

Is this tool designed to scan only Bubble apps you own, or to scan any 3rd party Bubble apps once I link one Bubble app?

Using your tool, I was able to scan 3rd party Bubble application by timing attack. You’d better fix it if it’s not your design.

[b.demontecler]

Hello @michitomo , you can run a test on any application, but only the owner can see the details of the vulnerabilities to prevent bad people from using our tool

[michitomo]

@b.demontecler
This is example result of the app not owned by me. Is this expected?

[b.demontecler]

I saw that you added the plugin on your app with the correct ID, i don’t understand why you said that you are not the owner. Do i miss something? Can you answer to my PM and plan a call to help me to understand? Thanks a lot for your help!

[michitomo]

This is not the app I have control. I’ll contact you anyways.

[b.demontecler]

Thanks a lot @michitomo, we fixed the issue with your help . Now, even with the workaround used, a user cannot scan an application that he doesn’t own. We haven’t seen other users using this workaround, thank you very much for your help

[michitomo]

Thanks a lot.
Even before the fix, being able to scan the app you don’t own is not actually a security concern anyways.

[noah2]

@b.demontecler thanks so much for you help and offering such an excellent service. I couldn’t recommend this service any higher. Happy to know our app is protected!

[klobassimon]

@b.demontecler Thanks for the thorough security audit and advice. Everyone using Bubble should be using this plugin and application, its the best way to secure your app.