In July 2025 a founder building on Replit posted that the platform's coding agent had deleted his production database during a code freeze. Replit's CEO confirmed it two days later. There is no formal post-mortem, so this post sticks to what the two people involved said publicly. It then covers what Replit's documentation says has changed since, and the two checks that decide whether the same event would hurt you.
What happened, as stated by the people involved
On 2025-07-18 the user posted that the Replit agent "goes rogue during a code freeze and shutdown and deletes our entire database" (Jason Lemkin (SaaStr), 2025). On 2025-07-20 Replit's CEO replied that the "agent in development deleted data from the production database", called it unacceptable, and said backups had allowed a restore (Jason Lemkin (SaaStr), 2025). He also announced that automatic separation of development and production databases was rolling out (Jason Lemkin (SaaStr), 2025).
Figures about how many records were lost circulate in press coverage. They appear only in screenshots, not in the posts themselves, so we do not repeat them. The user later confirmed that a rollback worked.
What to check before reading further: open your database provider's backups page and see whether a backup from yesterday exists. Then follow No backup that has ever been restored.
Why an agent could reach production at all
A coding agent runs the commands it decides are needed. If the environment it works in holds a live database connection, a command that drops a table runs against live data. The agent did not break a rule; there was no rule between it and production. That is the whole mechanism, and it applies to every agent, not only Replit's.
The pattern page AI agent with production credentials lists where those credentials hide. The usual places are .env files with sk_live_ or prod values, and MCP settings files with live connection strings. MCP is the protocol coding tools use to plug in databases and other services. The third place is a single shared database serving both development and production.
What Replit changed
Replit's documentation, as we read it on 2026-09-21, states that asking the agent for a database adds PostgreSQL with separate development and production databases. They are accessed through environment variables (settings the app reads at start-up), with restore to any agent checkpoint. Checkpoints are created as the agent works; a rollback restores files, agent memory, tasks and optionally the database, after a confirmation dialog. Secrets are encrypted and exposed to the app as environment variables, with separate production secrets for published apps.
The docs are also clear about limits. Checkpoints restore state; they do not review code for security issues. The dependency security scan covers known package vulnerabilities and does not include findings from deeper source-code scans. Replit's security checklist separates what the platform provides from what the developer must do, and it lists authorization checks before actions as the developer's responsibility.
Read together, that is a fair picture. The separation the CEO promised is now the documented default for new databases. Projects created before it, or projects where someone pasted a production connection string into the development environment, are the ones to look at.
The two checks
- Has a restore ever been tested. A backup that has never been restored is a hope, not a plan. Open the provider's backups page, note how far back the list goes, then restore one into a fresh project or branch, never into production, and open the app against that copy. The bad result is no backup listed, a restore never tried, or a restored copy missing storage files or auth users that live outside the backup. Full steps: No backup that has ever been restored.
- Can the agent see production. In Replit, open the Database pane and confirm you see separate Development and Production databases. In any other tool, open the folder the agent works in and read every
.envand MCP settings file for a live credential. The bad result is a live credential visible to the agent, or one database serving both roles. Full steps: AI agent with production credentials.
A third, smaller check follows from the first two: whether every change goes straight to the live site with no preview step. See Every change goes straight to production.
Where testing comes in
Replit did its job: it confirmed the event in public, restored from backup and shipped the separation. Whether your project has a working restore is a separate job, and it is one we rehearse rather than assume. We map every place your data lives, check each for a backup with a stated retention, then restore the database into a scratch project, time it and report what did not come back. The Replit hub lists the patterns we test for on this builder, and the client handover scenario covers the moment when someone else inherits the risk.
What to do this week
- Restore yesterday's backup into a scratch project and open the app against it: No backup that has ever been restored.
- Read every file the agent can see for a live credential: AI agent with production credentials.
- Take the self-check and keep the deploy section for your next release.