Bubble test data

The Fitting Room brief was pasted word for word (1,689 characters) into the editor's Agent at 11:32 UTC on 26 October 2026. My first two tries on Bubble's start page lost the Agent's plan when the free trial began, so the clock restarted here. The clock stops when the app is live and the checks pass: 25 of 30 on the full scale, applied here as 20 of the 24 checks that need no keys of mine.

The Agent answered with a 23-step plan after about two minutes. I approved it at 11:34 and it built for about 13 minutes. The first build used 483 of the 1,000 AI credits. I deployed it at 11:53, 21 minutes after the brief, and the app was live on its bubbleapps.io address.

The live app was not finished. Its timetable was empty, because the three seed classes sat only in the development database. I added the classes through the admin screen, gave two members credits in the data view and renamed the instructor in the data view. With that done 20 of the 24 checks had passed when I logged the results at 12:19, 47 minutes after the brief, in 1 prompt and 1 plan approval.

• Three hand steps in the data view and admin screen were part of the 47 minutes.

The checks were run against the live app, by hand, with a note per check. The six checks that need your own Stripe and email keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more (23 or more), 4 needs 80% (20), 3 needs 60% (15), 2 needs 33% (8) and 1 is below that.

21 of 24 checks passed, which is 87.5%. Passing: sign-up (C01), log-out and log-in (C02), the emailed password reset with a new password that worked (C03), the three screens by role (C04), instructors and capacity on the timetable (C06), booking, My bookings and cancelling with the place freed (C07 to C09), the full-class rule, shown as Class full (C10), the no-credit message (C11), member A never seeing member B's bookings (C12), the instructor seeing only their own classes (C13), Mark attended (C15), the admin adding, editing and deleting classes (C16 to C18), every booking, the CSV, the counts per class (C19 to C21), and the Ask the studio form with the admin's list (C22, C23).

Three failed. The timetable was empty after the deploy (C05), so only 7 of the 10 seed facts showed and the classes had to be typed in by the admin (C30). The instructor screen listed Power Reformer but never Reformer Basics, although the same instructor teaches both and a member had booked it (C14). Nothing was invented: no extra class, price or instructor.

• Payments and the declined-card check were not run: they need your own Stripe key.

Sign-up, log-in and password reset for a member, an instructor and an admin on the live app, then two attacks: a member asking for another member's bookings, and a member calling an admin-only action. I also read the Booking, User and Order privacy rules in the editor.

Every flow worked. The reset email arrived within seconds from a Bubble address and logging in with the new password worked while the old one failed. Attack 1 was blocked: the app's Data API is off and the Booking privacy rules show a booking only to its owner or to an admin. Attack 2 was blocked: a member who opened /admin was sent back to the home page, and the app exposes no public workflow endpoint for deleting a class.

The weak spot is the sign-up form. It has three options, Member, Instructor and Admin, and any visitor can choose Admin. I did that with a new account, and it opened the admin screen with every booking and member email, and with the right to delete classes. The privacy rules key on the role, so the choice defeats both attacks. A fix belongs in the app: do not offer the role at sign-up.

• Bubble's own security scan was not run.

The six data checks: the form and bookings write real records, they survive a reload, a redeploy and a design change, the admin can view, filter, edit and delete them, and they export as a file.

Proved (six): the Ask the studio form and the bookings wrote records; they stayed after reloads, after nine redeploys and after the colour change in E03; the admin viewed, edited and deleted records in the app, and viewed, filtered and edited them in the Data tab; and the bookings exported as a CSV with one row per booking.

Bubble keeps a development and a live database. The seed classes and the capacity change in E05 went into the development one only, which is why the live app was empty after the deploy.

• The Data tab's Export and backup buttons were looked at, not run.

The twelve scripted changes, one prompt each, then the live app opened to see whether the change had happened. I stop when fewer than 80 AI credits are left and never buy more.

Eight of the twelve ran. 6 worked first time: a phone field with a Members list on the admin page (E01), Instructor renamed Coach (E02), dark green and cream (E03), an About page with the brief's address, phone and email (E04), a Filter by coach box (E06) and an email when the admin cancels a booking, for which the Agent had to build the admin's Cancel booking button first (E08).

E05 did not work: the Agent set Power Reformer's capacity to 4 in the development database only, and the live timetable still said 6. E07 worked only after a second message: when I reported the planted bug, the Agent said it was not a bug and asked what I wanted, and a third message restored the credit refund. E09 to E12 were not run.

The eight used 478 AI credits, from 517 to 39. The cheapest change cost 28 credits, the dearest 95.

• The four unrun changes might have changed the grade either way.

Deploy to the vendor address, timed, then a Lighthouse phone run on the home page of https://info-80867.bubbleapps.io.

The Deploy button asked for a short description and the app was live in about 3 seconds on its bubbleapps.io address. Every redeploy after a change took about 5 seconds and cost no AI credits. The Settings screen offers a custom domain on Starter and above; I did not try it.

The phone score was 57. The largest contentful paint was 8.8 seconds and the page weighs about 1.3 MB.

A timetable with 100 seeded classes, layout faults at three widths and a real phone were not tested.

• Home page only; no domain; no layout fault count.

Looking for a way to take the app out: the export options in the editor's Settings (General, API, Versions, Domain and email, SEO) and in the Data tab. Read only: I ran no download.

I found no option to export the code or the app. What exists is a CSV of the records through the Data tab's Export button, the admin page's CSV of bookings and an optional Data API, which is off. I did not read the terms.

• Settings and the Data tab only.

The plan page, the AI credit meter and the pricing page (monthly view) were read on 26 October 2026. Bubble shows AI credits, not a price per prompt.

I paid nothing: the workspace was on a 14-day free Starter trial, and the plan page said the card on file would be charged on 9 November 2026. I cancelled the trial when testing ended (Settings, My plan, Downgrade, Cancel trial), so nothing was charged. The dialog warned that the live app would be unpublished immediately, and it was: the bubbleapps.io address now redirects to a page saying live sites are not supported. The AI credit meter read 961 of 1,000 used (96%) on Starter, and the editor then warned that the balance was low.

Monthly prices: Free $0 (500 AI credits, development only), Starter $39 (1,000), Growth $134 (2,000) and Team $399 (4,000). A live site needs Starter. The twelve changes did not fit in the 1,000 credits, so a top-up would have been needed.

• Yearly prices were not tested at the checkout. Trial credits are the Starter allowance.