JSON Sanitizer

A raw Bubble export contains your API keys. The JSON Sanitizer strips the secrets out and gives you back a file that is safe to send to a colleague, a contractor, or an AI.

If you are about to share an export with anyone, run it through here first.

Why this matters

The export is a complete description of your application, and that includes credentials. Depending on what your app uses, a raw export can contain live Stripe keys, API Connector authentication headers, plugin API keys and third-party service credentials.

People share Bubble exports far more casually than they would share a .env file. It is the same class of secret.

What to upload

Any JSON object. In practice, your Bubble application export as .json or .bubble.

If the file is not a JSON object you get "JSON must be an object with keys. This file has an unexpected format.", and if it is malformed, "Invalid JSON file. Please check the file and try again."

Drop the raw export in and get a cleaned copy back.

Exactly what is removed

All of settings.secure is deleted outright.

These keys under settings.client_safe are deleted outright, because they hold credentials end to end and there is no safe structure to keep:

appconnector
general_keys
stripe_public_key_live
stripe_public_key_test
comments_viewers
plugins

API Connector calls are kept but emptied. The structure under apiconnector2 survives — service names, endpoint URLs, methods, parameter names — while every scalar value is replaced with <redacted> and every stored sample response is stripped.

Strings kept inside the API Connector block are scrubbed against a set of credential patterns, covering Stripe secret and restricted keys, publishable keys, bearer tokens, AWS access key IDs, Google API keys, Slack tokens and JSON Web Tokens. It is a safety net for a key riding along in a URL or a body template rather than in a parameter value. That scan runs nowhere else, so a credential hardcoded outside settings, in a workflow action or an element property, is not caught.

Exactly what is kept

The API call structure. That is deliberate: someone reviewing your app needs to know that it calls a given endpoint with given parameters. They do not need the key.

Everything outside settings passes through untouched, so your pages, workflows, data types and styles are all intact.

The trade-off

Removing settings.client_safe.plugins costs you one thing: the Workflow Tracer reads that key to turn plugin action identifiers into readable plugin names. A sanitized export still traces workflows correctly, but plugin actions show raw identifiers.

The Design System tool is unaffected — the design-related keys it needs are deliberately preserved.

So: sanitize when sharing, use the original when working on your own machine.

Output

You get back <your-file>-clean.json (or -clean.bubble), with the original formatting preserved, plus a summary of what was removed.

The summary after cleaning a real 5.6 MB export. It names every key it stripped and every key it deliberately kept, so you can check the list against what you expected.

Verify it yourself

You do not have to take our word for it. Open the cleaned file in a text editor and search for the keys you know are in your app. This is a good habit with any tool that claims to remove secrets.