Replit's security checklist is written for apps built with Agent and separates what the platform provides from what the developer must add.
Replit's Agent writes the code, provisions a PostgreSQL database with separate development and production copies, and publishes to a .replit.app domain. Secrets are stored encrypted and exposed as environment variables; Replit Auth offers sign-in with Replit accounts.
Replit's security checklist for Agent-built apps separates what the platform provides from what you add. The main things to add are authorization checks in your own code, rate limits, and a habit of never letting an agent touch production data directly. The checks below follow that split.
Each row is taken from the vendor's documentation on the date shown. Defaults change; the date is the claim.
| Area | Default | Source |
|---|---|---|
| Frontend | Agent builds web apps, mobile apps, dashboards and AI tools in one project; the docs do not name a default frontend framework. | docs · verified 2026-09-21 |
| Backend / database | Asking Agent adds a PostgreSQL database, accessed through environment variables, with separate development and production databases and restore to any Agent checkpoint. | docs · verified 2026-09-21 |
| Auth | Replit Auth signs users in with their existing Replit accounts on a Replit-branded page; there is no setup beyond asking Agent, and it runs as a single environment. | docs · verified 2026-09-21 |
| Hosting | Publishing creates a .replit.app domain. Access can be Public (anyone with the link), password protected, workspace-only or invite-only; custom domains are supported. | docs · verified 2026-09-21 |
| Secrets / env vars | Secrets are encrypted (AES-256 at rest, TLS in transit) and exposed to the app as environment variables. Collaborators can view names and values; secrets are available to all deployment types except Static. | docs · verified 2026-09-21 |
| Source access | Git pane with one-click GitHub sync; import from and push to GitHub repositories. | docs · verified 2026-09-21 |
| Database access rules | The security checklist states Agent uses ORMs by default, which helps prevent SQL injection; authorization checks before actions are listed as the developer's responsibility. | docs · verified 2026-09-21 |
| Payments integration | Stripe keys (STRIPE_SECRET_KEY, STRIPE_PUBLISHABLE_KEY, STRIPE_WEBHOOK_SECRET) go in app secrets, not code; Agent sets up the Stripe flow and you swap test keys for live keys to go live. | docs · verified 2026-09-21 |
Documentation home: docs.replit.com/
40 patterns in the catalogue name Replit; the most severe are listed here across secrets and keys, data access, login and permissions, payments, ai features, deploy and config. Attribution is descriptive: the default stack makes the pattern reachable, or a public incident names it.
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Anyone who reads the code or guesses a common placeholder can sign in as the administrator.
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
Anyone who views the page source can copy the key and run their own workloads on your account until the bill or the provider stops them.
Whoever can influence the model's input can delete tables, email your whole customer list, or trigger any other action the app has wired up.
Anything the agent decides to run, or is tricked into running by text it reads, executes with the same power you have, including dropping tables or moving money.
Anyone who views the page source can take the key and run up charges, send messages or pull data on your account until the key is revoked.
Keys, session tokens and database connection strings end up in log files and in HTTP responses that anyone can trigger, which hands out credentials and a map of the system's internals.
An old reset email found in a shared inbox, a forwarded thread or a breached mailbox lets someone take over the account months later.
Someone who once had a user's token, on a shared computer or through a leak, keeps access after the user logs out or changes their password.
A customer is charged twice after a network hiccup, or a replayed webhook tops up an account again and again for a single payment.
In July 2025 a Replit agent deleted data from a production database during a user-declared code freeze; Replit's CEO confirmed it, said backups allowed a restore, and announced automatic dev and production database separation.
Jul 2025 · Jason Lemkin (SaaStr) · all sources
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
Feb 2026 · Taimur Khan · all sources
On the Base44 app builder, undocumented registration and one-time-password endpoints accepted a non-secret app_id, so anyone could create a verified account on a private app; Wix fixed it within 24 hours.
Jul 2025 · Wiz Research · all sources
Each entry links to its primary source in the evidence list. What to do about it is the self-check below.
Stated from the vendor's documentation. The limits are the vendor's scope statements, not judgements.
Agent checkpoints
Agent creates checkpoints as it works; rollback restores files, Agent memory, tasks and optionally the database, after a confirmation dialog.
Where it stops: Checkpoints restore state; they do not review code for security issues.
vendor docs · verified 2026-09-21
Secrets manager
Encrypted secrets store surfaced as environment variables, with separate production secrets for published apps.
Where it stops: Organization members without the Owner role cannot view values in the UI but can read them by printing environment variables, per the docs.
vendor docs · verified 2026-09-21
Dependency security scan
Checks project dependencies against public vulnerability records (CVEs), runs automatically and on demand in the Security Center, with a Fix with Agent option.
Where it stops: The docs state it covers known package vulnerabilities and does not include findings from deeper source-code scans.
vendor docs · verified 2026-09-21
HTTPS and Replit Auth
HTTPS is on by default for all applications; Replit Auth is offered as the built-in login option.
Where it stops: The checklist lists input validation, CSRF tokens, authorization checks, security headers, rate limiting and cookie flags as work the developer must do.
vendor docs · verified 2026-09-21
The critical patterns first. Each uses the dashboard and your browser.
.env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.A bad result is account A's record appearing for account B, or an edit or delete going through.
A bad result is a page loading, or a raw data list appearing, without a sign-in prompt.
Replit pre-launch checklist
40 checks, in the order we run them. Usable without buying anything.
Self-check tool
Answer questions about your app and get the patterns that apply, ordered by severity. Runs in your browser; nothing is sent.
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
All packages and prices. Every report includes a re-check after your fixes.
Replit's checklist covers platform basics like HTTPS, encrypted secrets and ORM use. What remains yours: that every route checks the caller's permission, that the production database is separate from the one the Agent works on, and that public endpoints have rate limits. The pre-launch check tests all three.
Agent runs with the permissions you give it. Keep it working against the development database, use checkpoints before large changes, and review what it wrote in routes that read or write user data. The evidence page lists the July 2025 incident and what Replit changed afterwards.
Replit's docs now describe development and production databases as separate, with the Agent not able to modify production directly. If your app predates that or you gave the Agent production credentials, check the pattern page on agents with production access for the exact steps.