Security Is Now the Most Important Topic in Tech

Since mid-October, the Bubble platform and the applications we host have been targeted by an unknown threat actor that’s been trying to gain access to our systems. We don’t know who is behind the campaign — they constantly switch IP addresses and conceal their tracks — but I can tell you this: It doesn’t feel like it’s a human.

We aren’t the only ones being targeted. We’ve been following the “Black October” news coverage and the Binance hack, but that’s the tip of the iceberg. Fortune mentions 100 compromised companies all caused by one AI-powered hacking operation. Most cybersecurity incidents don’t make the headlines at all, and many companies may not even realize they’ve been hacked. We have reached a critical threshold with AI, the moment that experts have been predicting ever since Mythos was announced: Models capable of sophisticated autonomous cyberattacks are now widely available.

What it feels like to fight the swarm

We host millions of applications on Bubble, so we’re used to being continually under attack. At any given point in time, someone is running a security scanner or penetration test or DDoS attack against at least one Bubble app. What we are seeing now is something new. The threat actor we’ve been tracking works 24/7, has unlimited patience, constantly tries new things and changes its approach, and when they do discover a potential opening, they try to exploit it within seconds. They combine the persistence and speed of an automated scanner with the cleverness of a human hacker.

On Monday, Oct 26th, they managed to get partial access to our production systems. They were able to access some user data, including private data uploaded by Bubble plugin developers. You can see our preliminary root cause analysis of the incident here. We locked down our systems and took away their access, at the cost of temporary downtime for some of our customers. But they didn’t give up. They kept trying new things, which led to more disruption for certain Bubble apps as we rolled out code to lock down any potential access points and stay one step ahead of them.  

Saturday morning, I shared a note with the whole company after one of the longest weeks in Bubble’s history. The night before, I had been up with some of our engineers til 4:30 AM working to prevent a line of attack that seemed like it might succeed. We were staying on top of things, but the team was running on adrenaline and caffeine. What I told the company that morning was to assume that this is the new normal. We don’t know if or when this current round of attacks will stop, and even if they do stop, now that the technology is out there, we have to assume someone else could launch a similar attack at any time. 

I told our team that a company can’t run in emergency mode 24/7 indefinitely, and that we are investing in our ability to defend ourselves without a continuous fire drill. If this is the new normal, we need to adapt. We have to change the way we operate so that being under this level of cyberattack isn’t an emergency, just business as usual. In the past, that was true for a small handful of giant tech firms like Amazon and Google. Today, that’s true for everyone.

Our mission as a company is to make building technology accessible so that you can safely and effectively build tech-empowered businesses without needing a team of world-class engineers. So it’s clear to us that the most important thing we can do right now is help our customers stay secure in this new environment. The rest of this post will discuss what we’re doing to secure ourselves at the platform level, and how we’re helping our customers secure the applications built on top of us.

Moving at the speed of AI

We don’t think traditional cybersecurity practices are enough by themselves to keep up with how fast the landscape is changing. The idea of running a penetration test once a quarter now seems like a joke. Under an AI attack, intrusion detection systems produce findings faster than a human team can understand what’s important and what’s noise. 

It’s a maxim in cybersecurity not to rely on “security by obscurity” — counting on attackers not knowing who you are or how your system works — but in practice, the industry tacitly relied on the days of human labor it used to take to penetrate a system. Smaller companies assumed they wouldn’t be targeted; larger companies assumed that they had weeks or months to fix obscure weaknesses. Now, one hacker can go after hundreds of companies simultaneously, and they can have a swarm of agents systematically map every possible attack surface.

The only way through is to fight fire with fire. We are using AI to automate every part of our defenses: monitoring our logs to detect that an attack is underway and follow its process in real-time, proactively discovering vulnerabilities in our own systems before they can be exploited, and rapidly making changes to our code and infrastructure to close holes and shut down attacks. We’re still using the traditional tools of cybersecurity, but we now have joint human/AI teams driving them, with AI handling the rapid response and monitoring at scale, and humans making the critical judgment calls. 

We were experimenting with these techniques before we came under attack, and we’ve now made them our standard way of operating. The volume of data the attacks have been generating would have taken days to go through with traditional tooling, but now, we’ve been able to stay on top of what the attackers have been doing in real time. Infrastructure changes that would have taken weeks are now being shipped in hours. Our systems are blocking new attack avenues before the humans on our team even have a chance to react.

Securing Bubble applications

As a hosting platform, we can help keep apps secure by defending the infrastructure they’re built on. And we’re not just any platform, we’re the leading no-code platform, which means we can help secure the applications users build as well: Bubble apps are built out of building blocks that we maintain rather than passing that maintenance cost on to our customers. Bubble users don’t have to worry about keeping their software dependencies up to date or finding flaws in their email send logic.

However, we do need your help securing the business logic: your apps’ actual behavior. Because we’re a fully visual platform, that logic is transparent instead of hidden in opaque code. You can read your settings, workflows, and privacy rules to understand exactly what’s locked down and what isn’t. That said, many of you are running serious companies with complex business logic, and the bigger an app gets, the easier it is to miss things.

We’re here to help you catch those issues before they turn into security incidents, with two tools that help you audit your apps. We view them as complementary and we recommend using both:

The Bubble security dashboard has structured checks, some deterministic and some powered by AI, that catch the most common types of configuration issues in Bubble applications. That includes things like credentials that aren’t marked as private, API connector calls that are misconfigured, and privacy rules that have holes in them.

Our new MCP, which allows for unstructured AI-driven exploration of your app, is another powerful tool for validating the unique logic of your application. You can connect to it with one click using Bubble’s connector in Claude or plugin in ChatGPT, or manually connect to any other agent of your choice. We recommend starting an exploration session with a prompt like:

Given this new environment, we’re making additional security work, including behind-the-scenes changes to secure your apps, a top priority. As of a few days ago, we now use AI to automatically detect and block incoming requests from bad actors before they even reach your app, and we’re working on scaling up our system for proactively alerting you if we see what looks like an intrusion attempt.

We plan to invest more in our user-facing tooling this month, including adding additional checks to the security dashboard and surfacing findings more proactively to users to make it easier to find and fix issues in real time.

How we handle incidents

Here’s what you can rely on if an attacker does manage to find a vulnerability in Bubble’s platform:

• As soon as we detect the incident, we prioritize removing the attacker’s access as quickly as possible
• While we attempt to do this without disrupting Bubble applications, sometimes the fastest way to lock out an attacker is to temporarily disable parts of our infrastructure. If we believe there is a user-facing impact from a security measure we take, we’ll post an update to status.bubble.io. That status message will likely be vague initially, both because attackers can read our status page, and because it can take time to fully understand the scope of a cyberattack.
• Once we no longer believe the attacker has elevated access to our systems, we kick off a forensic investigation to identify how the attacker gained access, any potential ways back in they still might have, any changes they made to our systems, and any sensitive data they may have read. 
• If we discover that the attacker subverted one of our platform controls to access user data, we’ll reach out to the impacted users as needed, typically over email, to explain what happened. We aim to do this on a rolling basis as we learn things, without waiting for the full forensic investigation to complete.

Building a secure future

We’re at an inflection point in the technology industry, and we’re just starting to feel the impact of AI on cybersecurity. My expectation is that this is only going to accelerate, and that what we’re seeing today in terms of attacker capabilities is going to look amateurish compared to what we’re seeing six months from now. 

We think no-code is in a unique position to help businesses make this transition successfully, and want to do our best to rise to the occasion. Stay tuned for more announcements from us as we continue to invest in security.