Security Assurance Review Certificates

Need help
1

Hi there,

I have a client that is making an application to a US Government Program (Los Angeles), that has a high level of security requirements for apps to be accepted.

As part of this, they require documented proof of some type of security assurance review from the following:

  • Vulnerability Scan
  • Risk Assessment
  • Security Audit
  • Penetration Test
  • Source Code Review

Are any of these something that Bubble would be able to provide a document for that we could present as proof? And how would we go about obtaining this? If not, are there any recommendations on services that would provide such a document in relation to my client’s Bubble app?

Thanks in advance,
Dave.

2

Hey Dave,
I hope you’re doing well.

You can have a look at @flusk’s website and reach out to them. They deliver security audits with certificates for Bubble apps.

3 Likes
3

Thanks! That looks like it will be very useful. I’ll send their website over to my client now.

Much appreciated.

4

This cannot be provided as Bubble owns the source code of their engine. Logic can be reviewed, but exploits within Bubble’s own platform can still exist and can’t be reviewed as we don’t have the code.

5

hi @daveshearing93
I have a similar question from a potential client.
Did you do an audit with @flusk ? and happy with it? (I reach out but didn’t hear from them yet…)

have you dived deeper into security of bubble and what did you find? for example I know they are SOC2 Type II certified, but I cant find their latest “assurance report” which sometimes SOC 2 Type II certified companies make public.

thanks so much,
Koen

6

Hi Koen,

We went with a Penetration Test with Flusk and have just finished up resolving the issues and have obtained the certificate we needed. We went with the automated test rather than the full service, and I handled the resolution of the issues on my end. The communication was a little spotty, but all good in the end, and the UI and features of the platform seemed great.

In terms of Bubble, they themselves are SOC-2 certified but this doesn’t extend to apps built on Bubble so I don’t think a certificate is obtainable without going through the whole process ourselves. We had a quote for a Type II certification (I believe from SecureFrame) for around $12,500, but luckily it turned out that it wasn’t necessary and the PenTest certificate was enough.

Hope that helps!

1 Like
7

thanks Dave! very useful. agree on SOC-2. hope to follow the same route. own certification (and following these requirements is too challenging and expensive…

8

This topic was automatically closed after 70 days. New replies are no longer allowed.