Bubble

That jacket that's been collecting dust in your closet for ten years rightfully belongs to someone in your city who would wear it, and Communitique exists to make sure it gets there. The app is free — neighbors post what they're letting go, find what they want, and meet up in person to exchange. Already, 3,000 people across the U.S. and France are using it to keep clothes in circulation and out of landfills. The minds behind the platform are Heather Masson-Forsythe, Ph.D. and Margaux Masson-Forsythe — a federal science policy advisor and a machine learning engineer fighting deforestation. They got tired of watching perfectly good clothes go nowhere. Link below to give your wardrobe a new life.

Vibe coding is having its security reckoning, and the industry is going to look very different on the other side of it. This week, one of the major vibe coding platforms acknowledged that any free account could read source code, database credentials, and AI chat histories from projects built before late 2025. The root cause was a textbook authorization flaw on legacy endpoints. The bug had been reported 48 days earlier. Zoom out and the pattern is clear: The bottleneck in software is no longer "can we build it." It's "can we trust it." We've spent two years optimizing the first 10% of the build cycle — getting from idea to working prototype in an afternoon. We've spent almost no time on the other 90%: auth models, data ownership, key management, audit logs, incident response, the boring durable parts that decide whether your app survives contact with real users. The risk for the industry is real. If the public's first encounter with AI-built software is "my data was readable by a stranger," we will set this category back years. We don't get a do-over on trust. A few things have to change, fast: For platforms: security is not a feature, it is the floor. Private by default. Permission checks audited continuously. Secrets handling that does not depend on the user knowing what a secret is. Bug bounty programs measured in mean-time-to-fix, not mean-time-to-acknowledge. For end users: ask the platforms you build on what their security model actually is. Where do credentials live? What's exposed by default? What happens when a researcher reports a flaw? If you can't get a clear answer in one paragraph, that itself is the answer. For the industry: stop treating security as the part you'll figure out after PMF. The companies that win the next decade will be the ones that made security boring, predictable, and assumed — not the ones that shipped the prettiest demo. Speed got us here. Trust will decide who's still here in five years.

The property editor has been through an overhaul based on your feedback, and the redesigned version is now available to everyone. The popovers burying your workflow are gone, inserting dynamic data is now smooth and consistent, and the visual experience is cleaner and faster to scan. We also added drag-and-drop for conditionals and custom states, a searchable color picker, and auto-focus when creating expressions. We've documented every change on the forum since December — what we heard, what we fixed, and what we added. Toggle it on when you're ready, toggle it back off if it's not for you yet.

Sprint 7 is live! For the Agent, edit proposals now render as structured plan cards with numbered steps, permission enforcement is end-to-end, and image uploads are enabled for everyone so you can show Bubble AI exactly what you're working with instead of describing it. On the mobile side, push notification deep linking is shipped, and inputs are tappable anywhere in the field. Full release notes in the comments. 💙

Biomedical science isn't the first subject that comes to mind for a bedtime story, but BLAST Reader is making the case that it should be. This week's Mobile Monday turns bedtime into something a little more ambitious. It’s a beautifully illustrated story app that teaches kids biomedical science through imagination rather than instruction. The kind of app that makes a parent feel good about handing over a screen at bedtime. https://lnkd.in/e9afDMwa https://lnkd.in/eD5rCp5B

Your users deserve a direct link to exactly what they're looking for in your app, and now they can have one. The new "Create a mobile deep link" workflow action generates a standalone URL you can drop into a transactional email, let users copy and share via WhatsApp or iMessage, store in a database at signup, or pass into any other workflow step you can think of. The navigation config is the same one you already use for push notifications, so the only thing that changed is how much you can do with it. Find it under Native Mobile in your action picker, and check the docs for the full setup guide.

We asked Ally Cody a few questions to help you ace your next engineering interview.

Is now a bad time to announce we have the former CEO of Allbirds on The New Build? 🫣 Joseph Zwillinger built the brand from scratch, took it public, navigated a brutal turnaround, stepped down, and started over — and he'll tell you exactly what he learned at every stage. It’s the Allbirds post-mortem you didn't know you needed — out now.

Claude Opus 4.7 is now live in Bubble AI — we tested it early, shared technical feedback with Anthropic, and a 5–10% improvement in cross-page visual consistency is baked into all new app generations.