# Security vulnerability in profile-switching flow — intercepting and substituting a different user ID

**URL:** <https://forum.bubble.io/t/security-vulnerability-in-profile-switching-flow-intercepting-and-substituting-a-different-user-id/396765>\
**Category:** Questions\
**Created:** [June 1, 2026, 5:50pm UTC](https://forum.bubble.io/t/security-vulnerability-in-profile-switching-flow-intercepting-and-substituting-a-different-user-id/396765 "2026-06-01T17:50:12Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![sudsy](https://sea1.discourse-cdn.com/bubble/user_avatar/forum.bubble.io/sudsy/32/114637_2.png) [@sudsy](https://forum.bubble.io/u/sudsy)\
**Post date:** [June 1, 2026, 11:33pm UTC](https://forum.bubble.io/t/security-vulnerability-in-profile-switching-flow-intercepting-and-substituting-a-different-user-id/396765/7 "2026-06-01T23:33:17Z")

</div>

> [@richard32](#):
>
> Has anyone found a cleaner solution to this pattern that avoids returning any credential to the frontend?

The backend can actually “notify” the front end of data changes via the [Trigger a custom event when data changes](https://manual.bubble.io/core-resources/bubble-workflows/bubble-actions/custom-actions#trigger-a-custom-event-when-data-changes) action. You might find the technique outlined in [this post](https://forum.bubble.io/t/simpler-more-secure-alternative-to-api-app-connector-for-returning-data/379581) to be helpful.

---

_[View the full topic](https://forum.bubble.io/t/security-vulnerability-in-profile-switching-flow-intercepting-and-substituting-a-different-user-id/396765)._