# JSON Sanitizer

A raw Bubble export contains your API keys. The JSON Sanitizer strips the secrets out and gives you back a file that is safe to send to a colleague, a contractor, or an AI.

**If you are about to share an export with anyone, run it through here first.**

## Why this matters

The export is a complete description of your application, and that includes credentials. Depending on what your app uses, a raw export can contain live Stripe keys, API Connector authentication headers, plugin API keys and third-party service credentials.

People share Bubble exports far more casually than they would share a `.env` file. It is the same class of secret.

## What to upload

Any JSON object. In practice, your Bubble application export as `.json` or `.bubble`.

If the file is not a JSON object you get *"JSON must be an object with keys. This file has an unexpected format."*, and if it is malformed, *"Invalid JSON file. Please check the file and try again."*

[[img:json-sanitizer/01-upload.png|Drop the raw export in and get a cleaned copy back.]]

## Exactly what is removed

**All of `settings.secure`** is deleted outright.

**These keys under `settings.client_safe`** are deleted outright, because they hold credentials end to end and there is no safe structure to keep:

- `appconnector`
- `stripe_public_key_live`
- `stripe_public_key_test`
- `comments_viewers`

**The plugin manifest (`plugins`) is kept verbatim.** Plugin ids and version numbers are not secrets, and other LumiDevKit tools read that key to turn plugin action identifiers into readable names. Plugin HTTP header keys (`<pluginId>_header_*`), which frequently carry bearer tokens, have their values replaced with `<redacted>`.

**API Connector calls are kept but emptied.** The structure under `apiconnector2` survives — service names, endpoint URLs, methods, parameter names — while every scalar value is replaced with `<redacted>` and every stored sample response is stripped.

**`general_keys` is kept but emptied too.** This is the browser-exposed key partition, so its entries were already reachable from the running app. The key *names* survive — they are service identifiers (like `google_geocode_key`), useful when rebuilding an app's `.env` — while every string value is replaced with `<redacted>`.

**A credential-pattern sweep runs over the riskiest kept surfaces** — the API Connector's kept strings (including URL query values), plugin header values, workflow "Detect data" captures (`raw_data`, which can embed live tokens), creator-email policy keys (dropped wherever they occur), and every string inside `pages` and `element_definitions` (where plugin elements sometimes hold keys in their properties). The patterns cover Stripe secret and restricted keys, publishable keys, bearer tokens, AWS access key IDs, Google API keys, Slack tokens and JSON Web Tokens. The sweep does not visit workflow actions, option sets or styles — a credential you typed into one of those by hand is not caught, so skim them before sharing if you have ever pasted a key outside `settings`.

## Exactly what is kept

The API call *structure*. That is deliberate: someone reviewing your app needs to know that it calls a given endpoint with given parameters. They do not need the key.

Outside `settings`, your app's structure is fully intact — pages, workflows, element trees, data types, option sets and styles all survive. The only edits outside `settings` are the protective ones above: the credential-pattern sweep over `pages`/`element_definitions` strings, the `raw_data` capture redaction, and the dropped creator-email policy keys.

## What still works after sanitizing

Everything. The [Workflow Tracer](/docs/workflow-tracer) keeps readable plugin names (the plugin manifest survives), and the [Design System](/docs/design-system) tool's keys are deliberately preserved. A sanitized export is a full-fidelity structural copy of your app — minus the secrets.

So: **sanitize when sharing, use the original when working on your own machine.**

## Output

You get back `<your-file>-clean.json` (or `-clean.bubble`), with the original formatting preserved, plus a summary of what was removed.

[[img:json-sanitizer/02-result.png|The summary after cleaning a real 5.6 MB export. It names every key it stripped and every key it deliberately kept, so you can check the list against what you expected.]]

## Verify it yourself

You do not have to take our word for it. Open the cleaned file in a text editor and search for the keys you know are in your app. This is a good habit with any tool that claims to remove secrets.

## Related

- [Privacy and your data](/docs/privacy-and-your-data)
- [Get your app export out of Bubble](/docs/export-your-bubble-app)