Security notice
App built on Bubble? It says an attacker accessed some customers' API keys.
On October 26, 2026, Bubble, the no-code platform for building web apps, said on its status page that it detected unauthorized access to parts of its systems. Bubble says the attacker accessed third-party tokens and credentials, such as the API keys used in its API Connector and plugins, belonging to a subset of its users, and that it is contacting those users directly. Bubble says it believes the attacker has been contained, and that it does not have evidence the attacker accessed private data of apps hosted on Bubble or credentials stored inside non-public apps. It says its investigation is ongoing and the scope may change. If your app connects to payment, email, AI or other services through Bubble, check those accounts for unusual activity today.
What happened
- It began as an outage. At 12:54 PM ET on October 26, Bubble said it was working through an issue affecting platform availability, with some apps seeing errors or downtime while it made infrastructure changes. (Bubble status page)
- Then Bubble declared a security incident. At 2:59 PM ET Bubble wrote: "We detected unauthorized access to parts of Bubble's systems." It said it had "confirmed the attacker accessed third-party tokens and credentials (such as API keys used in API Connector / plugins) belonging to a subset of Bubble users" and was contacting affected users directly. It warned the scope "may change as we learn more." To contain the attack it took parts of its infrastructure offline, which affected both the Bubble editor and live apps. (Bubble status page)
- Contained, Bubble believes. At 6:04 PM ET Bubble said: "We believe the attacker has been contained and is no longer active in our systems," and that it had seen no evidence of further access since its previous update. (Bubble status page)
- What Bubble reports so far. In its 8:38 PM ET update, Bubble said forensic work is ongoing and listed what it can report: (1) it does "not have evidence that the attacker accessed private data of apps hosted on Bubble, or any credentials stored inside non-public Bubble applications"; (2) the attacker accessed metadata about Bubble plugins, including private API keys stored inside them, and Bubble has emailed the affected plugin developers to rotate those keys; (3) the attacker downloaded application data from apps set as publicly viewable in the editor, which Bubble says were already open to the public. (Bubble status page)
- Service is mostly back. By the late evening of October 26, Bubble said service to the majority of its customers was fully restored. It asked anyone still having problems who has not been contacted by Bubble to write to support@bubble.io. It said its forensic investigation continues and it does not expect further substantial updates until later this week. (Bubble status page)
Who should worry
- Your app, website, online store or internal tool is built on Bubble.
- Your Bubble app connects to other services through the API Connector or plugins, such as payments, email, text messages, AI or databases.
- You build or publish Bubble plugins.
- Your app's editor is set to be viewable by the public.
- A developer or agency built your app and you are not sure what platform it runs on. Ask.
A key or token works for whoever holds it, for the account it unlocks. That is why Bubble tells customers to look at their connected accounts. Bubble says it is still working out the full extent of what was accessed. (Bubble status page)
What to do now
Do these today.
- Ask the question. Send the message below to your developer or agency. You need a clear answer: does anything we run use Bubble, and which outside services does it connect to?
- Look at your connected accounts. Bubble recommends reviewing activity on third-party accounts connected to your Bubble apps for unusual usage. Check the payment, email, AI and other services your app uses, for charges, messages or usage you do not recognize. (Bubble status page)
- Rotate credentials when Bubble says. Bubble says it will tell customers when to rotate credentials so the new ones stay protected. Watch its status page and your email, and follow its instructions if it contacts you. If you see misuse in a connected account, contact that service and Bubble support. That last step is our advice. (Bubble status page)
- Plugin developers: rotate private plugin keys now. Bubble says the attacker accessed private API keys stored inside plugins and that it has emailed the affected developers to rotate potentially exposed keys. (Bubble status page)
- Check who can see your editor. In your app's editor, go to Settings > General and look at "Define who can see and modify the app editor." Bubble recommends "Private app" unless you mean the editor to be open to the public. (Bubble status page)
- Watch for phishing. Bubble says official messages about this incident come only from bubble.io and are posted at status.bubble.io, and that it will never ask for your password or credentials by email. (Bubble status page)
What to send your developer or agency
On October 26, 2026, Bubble reported unauthorized access to parts of its systems. It says the attacker accessed third-party tokens and credentials, such as API Connector and plugin API keys, for a subset of users, and accessed plugin metadata including private plugin API keys. It says it has seen no evidence of access to private app data or credentials in non-public apps, and that its investigation continues. Please confirm whether any of our sites, stores or apps use Bubble. If so, please tell us which outside services each app connects to, review activity on those accounts for anything unusual, rotate credentials when Bubble instructs, rotate any private plugin keys if we publish plugins, set the app editor to "Private app" under Settings > General unless it is meant to be public, and tell us what you find. Source: Bubble status page.
Common questions
Has my app or business been hacked?
This notice does not mean your app or business has been hacked. Bubble says an attacker accessed third-party credentials belonging to a subset of its users and that it is contacting those users directly. It says it has no evidence so far of access to private app data. Its investigation is still under way and it says the scope may change.
Can EverThread tell me if I am affected?
No. EverThread checks websites from the outside, the way a browser sees them. We do not test for this. We cannot see your Bubble account, your apps, your plugin keys, your editor settings or your accounts at other services, so we cannot tell whether any of your keys were accessed. Your developer and Bubble can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
My site does not use Bubble. Do I need to do anything?
Not for this incident. If you are not sure what platform your site or app runs on, ask your developer.
Where can I follow official updates?
The Bubble status page. Bubble also says it will email impacted customers.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Bubble: Bubble Status, platform availability and security incident, updates from October 26, 2026, checked October 27, 2026, about 8:20 AM ET