# JSON Sanitizer

A raw Bubble export contains your API keys. The JSON Sanitizer strips the secrets out and gives you back a file that is safe to send to a colleague, a contractor, or an AI.

**If you are about to share an export with anyone, run it through here first.**

## Why this matters

The export is a complete description of your application, and that includes credentials. Depending on what your app uses, a raw export can contain live Stripe keys, API Connector authentication headers, plugin API keys and third-party service credentials.

People share Bubble exports far more casually than they would share a `.env` file. It is the same class of secret.

## What to upload

Any JSON object. In practice, your Bubble application export as `.json` or `.bubble`.

If the file is not a JSON object you get *"JSON must be an object with keys. This file has an unexpected format."*, and if it is malformed, *"Invalid JSON file. Please check the file and try again."*

[[img:json-sanitizer/01-upload.png|Drop the raw export in and get a cleaned copy back.]]

## Exactly what is removed

**All of `settings.secure`** is deleted outright.

**These keys under `settings.client_safe`** are deleted outright, because they hold credentials end to end and there is no safe structure to keep:

- `appconnector`
- `general_keys`
- `stripe_public_key_live`
- `stripe_public_key_test`
- `comments_viewers`
- `plugins`

**API Connector calls are kept but emptied.** The structure under `apiconnector2` survives — service names, endpoint URLs, methods, parameter names — while every scalar value is replaced with `<redacted>` and every stored sample response is stripped.

**Strings kept inside the API Connector block are scrubbed** against a set of credential patterns, covering Stripe secret and restricted keys, publishable keys, bearer tokens, AWS access key IDs, Google API keys, Slack tokens and JSON Web Tokens. It is a safety net for a key riding along in a URL or a body template rather than in a parameter value. That scan runs nowhere else, so a credential hardcoded outside `settings`, in a workflow action or an element property, is not caught.

## Exactly what is kept

The API call *structure*. That is deliberate: someone reviewing your app needs to know that it calls a given endpoint with given parameters. They do not need the key.

Everything outside `settings` passes through untouched, so your pages, workflows, data types and styles are all intact.

## The trade-off

Removing `settings.client_safe.plugins` costs you one thing: the [Workflow Tracer](/docs/workflow-tracer) reads that key to turn plugin action identifiers into readable plugin names. A sanitized export still traces workflows correctly, but plugin actions show raw identifiers.

The [Design System](/docs/design-system) tool is unaffected — the design-related keys it needs are deliberately preserved.

So: **sanitize when sharing, use the original when working on your own machine.**

## Output

You get back `<your-file>-clean.json` (or `-clean.bubble`), with the original formatting preserved, plus a summary of what was removed.

[[img:json-sanitizer/02-result.png|The summary after cleaning a real 5.6 MB export. It names every key it stripped and every key it deliberately kept, so you can check the list against what you expected.]]

## Verify it yourself

You do not have to take our word for it. Open the cleaned file in a text editor and search for the keys you know are in your app. This is a good habit with any tool that claims to remove secrets.

## Related

- [Privacy and your data](/docs/privacy-and-your-data)
- [Get your app export out of Bubble](/docs/export-your-bubble-app)