<ul><li>Companies using Bubble, a low-code platform, have been found to forget to hide their Swagger documentation access, opening up the opportunity for a man-in-the-middle attack.</li><li>Accessing the Swagger documentation at /api/1.1/meta allows hackers to add, edit, delete, and create data without user authorization, as well as impersonate users.</li><li>Certain endpoints in Bubble's API do not require access tokens or credentials, exposing sensitive information such as property views and search appearances.</li><li>The responsibility for securing apps built on low-code platforms like Bubble lies with the developers, who need to implement proper security protocols.</li></ul>

Hacking bubble.io apps: For Education purpose only❗❗❗

Discover more