Hidden how? You mean not loaded yet from a search?
Interesting, I’m guessing you’re running some sort of Claude or GPT analysis on this? It can be pretty subjective.
You can securely have a client side redirect so long as the page’s content is invisible by default, and made visible by a server-side condition.
Yes, among other things
When you say “visible” do you mean literally the “is visible” condition? My understanding was that conditionals have no effect on what’s loaded since it’s purely clientside. Meaning if the group is invisible on load and the condition says “Visible if Current Users’s Role is Admin,” someone can still see the group using dev tools.
Basically, it’s complicated.
Hidden elements can be downloaded, even if there is no condition to ever make them visible (or no show group / toggle group).
It’s not clear exactly when, but Bubble does this to pre-cache element loading. That’s why switching screens on SPAs is generally so fast.
Exactly how much is pre-cached I cannot work out or reliable replicate, so you have to search static.js to see if your element is being loaded on the page load and verify it’s secure that way.
Edit: That said, I have not worked out yet to what extent that permits users to take actions, even if they can see the elements (i.e it’s not necessarily problematic if they can see what elements are on an admin panel, so long as they cannot execute workflows inside of the groups that should be invisible)
Hmm… I think I’ll stick to server-side redirects and workflow conditions. Would love to see a list of known insecure plugins though, think that would be of great benefit to the community.