How to secure an app built on Replit
Last updated
Keep every key in Replit Secrets, never in files; check whether your project’s code is visible to others; deploy with Replit Deployments rather than sharing the development URL; require auth and scope queries on every API route; rate-limit AI endpoints; and scan the deployed URL for leaked keys, exposed files and missing headers.
Where Replit apps leak
Replit makes it easy to go from prompt to running app, and the same convenience causes the common leaks: a key pasted into a file instead of Secrets, a development URL shared as if it were production, and API routes the agent wrote without checking who is calling them.
Secrets are exposed to your code as environment variables. Anything your front end bundles is still public, so a secret used in browser code is leaked even when it came from Secrets.
The checklist
- Move every API key and database URL into Replit Secrets and delete them from files, including old commits if the project is connected to Git.
- Check the project’s visibility settings. If others can see your code, treat anything in it as public.
- Publish with a Replit Deployment and share that URL, not the workspace preview URL.
- In every API route, check the session and scope queries to the signed-in user.
- Put AI calls behind auth with a per-user rate limit, and set a spending limit with the AI provider.
- Add a privacy policy and terms before collecting emails or payments.
- Scan the deployed URL and fix critical and high findings before you launch.
Questions
- Are Replit Secrets safe?
- They keep keys out of your files. A secret still leaks if your code sends it to the browser, so use secrets only in server code.
- Can Defexity scan a Replit app?
- Yes. Scan the deployed URL; connect GitHub if the project syncs to a repository for code and dependency checks.
Related Defexity checks
Sources
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.