JSON Sanitizer

A raw Bubble export contains your API keys. The JSON Sanitizer strips the secrets out and gives you back a file that is safe to send to a colleague, a contractor, or an AI.

If you are about to share an export with anyone, run it through here first.

Why this matters

The export is a complete description of your application, and that includes credentials. Depending on what your app uses, a raw export can contain live Stripe keys, API Connector authentication headers, plugin API keys and third-party service credentials.

People share Bubble exports far more casually than they would share a .env file. It is the same class of secret.

What to upload

Any JSON object. In practice, your Bubble application export as .json or .bubble.

If the file is not a JSON object you get "JSON must be an object with keys. This file has an unexpected format.", and if it is malformed, "Invalid JSON file. Please check the file and try again."

Drop the raw export in and get a cleaned copy back.

Exactly what is removed

All of settings.secure is deleted outright.

These keys under settings.client_safe are deleted outright, because they hold credentials end to end and there is no safe structure to keep:

appconnector
stripe_public_key_live
stripe_public_key_test
comments_viewers

The plugin manifest (plugins) is kept verbatim. Plugin ids and version numbers are not secrets, and other LumiDevKit tools read that key to turn plugin action identifiers into readable names. Plugin HTTP header keys (<pluginId>_header_*), which frequently carry bearer tokens, have their values replaced with <redacted>.

API Connector calls are kept but emptied. The structure under apiconnector2 survives — service names, endpoint URLs, methods, parameter names — while every scalar value is replaced with <redacted> and every stored sample response is stripped.

general_keys is kept but emptied too. This is the browser-exposed key partition, so its entries were already reachable from the running app. The key names survive — they are service identifiers (like google_geocode_key), useful when rebuilding an app's .env — while every string value is replaced with <redacted>.

A credential-pattern sweep runs over the riskiest kept surfaces — the API Connector's kept strings (including URL query values), plugin header values, workflow "Detect data" captures (raw_data, which can embed live tokens), creator-email policy keys (dropped wherever they occur), and every string inside pages and element_definitions (where plugin elements sometimes hold keys in their properties). The patterns cover Stripe secret and restricted keys, publishable keys, bearer tokens, AWS access key IDs, Google API keys, Slack tokens and JSON Web Tokens. The sweep does not visit workflow actions, option sets or styles — a credential you typed into one of those by hand is not caught, so skim them before sharing if you have ever pasted a key outside settings.

Exactly what is kept

The API call structure. That is deliberate: someone reviewing your app needs to know that it calls a given endpoint with given parameters. They do not need the key.

Outside settings, your app's structure is fully intact — pages, workflows, element trees, data types, option sets and styles all survive. The only edits outside settings are the protective ones above: the credential-pattern sweep over pages/element_definitions strings, the raw_data capture redaction, and the dropped creator-email policy keys.

What still works after sanitizing

Everything. The Workflow Tracer keeps readable plugin names (the plugin manifest survives), and the Design System tool's keys are deliberately preserved. A sanitized export is a full-fidelity structural copy of your app — minus the secrets.

So: sanitize when sharing, use the original when working on your own machine.

Output

You get back <your-file>-clean.json (or -clean.bubble), with the original formatting preserved, plus a summary of what was removed.

The summary after cleaning a real 5.6 MB export. It names every key it stripped and every key it deliberately kept, so you can check the list against what you expected.

Verify it yourself

You do not have to take our word for it. Open the cleaned file in a text editor and search for the keys you know are in your app. This is a good habit with any tool that claims to remove secrets.