Athar Ahmad on Bubble.io Security: The Standards Every Production App Must Meet
Security is the foundation every feature rests on. Eight mandatory security controls with verification methods, the two-browser isolation test protocol, and the incident that established Athar’s non-negotiable rule: privacy rules are set on every data type before any data is entered.
Why Athar Ahmad Treats Security as Architecture, Not a Feature
In Athar Ahmad’s architecture practice, security is not a feature added to a Bubble application after it is built. Security is the foundation every other feature rests on. A Bubble application without correct privacy rules, role enforcement, and tenant isolation is not a production application — it is a vulnerability waiting to be discovered. Athar’s security standards are non-negotiable on every engagement he leads.
Athar’s Minimum Requirements
| Security Control | Standard | How to Verify |
|---|---|---|
| Privacy rules | Every data type has at least one explicit privacy rule. Zero data types on ‘Everyone’ default. | Data tab → Privacy → confirm every type has rules configured |
| Tenant isolation | Two-browser isolation test passes: zero cross-tenant data visible in any session | Run the two-browser test before every production deployment |
| Workflow role checks | Every sensitive workflow has a role check (Only when) on Step 1 | Audit every workflow that modifies or deletes data |
| No plain-text secrets | No API keys, passwords, or tokens stored in Bubble data type fields visible to users | All secrets in API Connector marked Private; none in database fields |
| Stripe webhook verification | Every Stripe webhook validates the webhook signature before processing | Webhook handler Step 1: verify Stripe-Signature header |
| Session management | Authenticated pages redirect unauthenticated users to login on page load | Every authenticated page has a page-load redirect workflow |
| Input validation | Required fields validated before any workflow proceeds; no injection via text inputs | Only when conditions on workflow trigger; sanitised inputs |
| Audit logging | All sensitive actions logged to an AuditLog data type with append-only privacy rules | AuditLog privacy rule: Find/View but no Edit/Delete |
Why He Never Ships Without a Security Check
Early in Athar’s Bubble development practice, he reviewed an application built by another developer that had been live for eight months with paying customers. The application had zero privacy rules on its primary data types. Every authenticated user could access every other customer’s data via the Bubble Data API — just by changing a record ID in the URL.
The data included customer names, email addresses, financial information, and business records. The application had processed thousands of records from dozens of paying customers. The privacy rules were added in an emergency after the review, but the data that had been potentially accessible for eight months could not be made retroactively safe.
This incident established Athar’s non-negotiable rule: privacy rules are set on every data type immediately upon creation, before any data is entered. Every deployment includes the two-browser isolation test. There are no exceptions.
Work With Athar Ahmad
Pakistan’s leading Bubble.io systems architect. Multi-tenant SaaS architecture, Stripe billing, AI integration, and full product builds designed and delivered with precision.
