Security: How to avoid Database Leaks on your Bubble app?

[nico.dicagno]

This is actually an edgecase which you have to account for.

If the user’s team is empty, the ‘User’s own team’ rule breaks down. This is because an unauthenticated user’s team (no team) is the user’s team (no team), so that privacy rule actually outputs a true.

Check out @georgecollier 's recent post about it.

Careful using only Current User's X in privacy rules

I’ve been auditing a few apps recently and quite a few have a similar issue. A common privacy rule is This Thing’s X is Current User’s X. For example, in a B2B app, that might mean This Note’s Organisation is Current User’s Organisation. For some reason, the Organisation field of the Note never got assigned. This Note’s Organisation is empty (due to error/logic bug) and Current user’s Organisation is empty (as user is not logged in) therefore This Note’s Organisation = Current User’s Orga…