Replit pre-launch checklist
Defaults referenced come from Replit's documentation, verified 2026-09-21, on the Replit hub.
Secrets and keys
- CriticalSecrets committed to the code repository
Open your project on GitHub (or the code view in your builder) and look at the file list for
.env,.env.local,.env.production,serviceAccountKey.jsonorfirebase-adminsdkfiles. - HighThird-party API key in the JavaScript bundle
Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
- HighSecrets and internals in error messages and logs
Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like
/api/anything-made-up.
Data access
- CriticalRecord ids accepted without an ownership check
Create two accounts in your app and add one record, such as an order or a note, in each.
Login and permissions
- CriticalAdmin routes without any login check
Open a private browsing window so you are signed out.
- CriticalAuthorization enforced only in the browser
Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
- CriticalDefault admin credentials left in place
In the builder's code view, search the whole project for admin@, password, seed and demo.
- CriticalTokens trusted without server verification
Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
- HighPassword reset links that never expire
Request a password reset for your own test account and keep the email.
- HighSessions that survive logout and password changes
Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
Payments
- CriticalStripe webhook accepted without signature verification
In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.
- HighNo idempotency on payment handlers
In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.
- HighPrice or plan taken from the client
Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
- HighSubscription state trusted from local storage
Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
- HighStripe test keys in production
Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning
pk_test_or a session ID beginningcs_test_.
AI features
- CriticalLLM API key exposed to the client
Open your live app, press F12, select the Network tab, and use the AI feature once.
- CriticalNo output validation before actions
List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.
- HighNo spend cap on model calls
Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set.
- HighPrompt injection through user content
List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers.
- MediumUnbounded input length to the model
Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit.
Deploy and config
- CriticalAI agent with production credentials
Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.
- HighCORS open to any origin with credentials
Sign in to the live app, open browser devtools, go to the Network tab and click any request to your API.
- HighDependencies with known vulnerabilities
If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
- MediumDebug mode left on in production
On the live site, open a page address that does not exist, then open an API route with a broken parameter, for example a letter where an id is expected.
- MediumMissing security headers
Open your published app in Chrome or Firefox, press F12 and choose the Network tab.
- MediumNo automated checks before deploy
Open the project's GitHub repository; if the builder has a GitHub sync, connect it first so the code is visible there.
- MediumEvery change goes straight to production
Open your hosting dashboard (Vercel: the Deployments tab) or the builder's publish panel and look at the recent deployments.
Reliability
- HighNo rate limiting on sensitive routes
Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
- MediumBackground jobs that fail silently
List every scheduled or background task your app has: on Vercel open Settings then Cron Jobs; on Supabase open Integrations then Cron, and Edge Functions; on Replit look for a Scheduled deployment.
- MediumErrors swallowed, spinner never stops
Open your app in Chrome and sign in as a normal user.
- MediumRetries with no pause and no cap
Open your app in Chrome, press F12 and choose the Network tab.
- MediumOne process, one machine, nothing restarts it
Find out where the app runs. In Replit, open the Publishing pane and read the deployment type. On a server or container host, open the provider's dashboard and look for "restart policy", "health check" or "process manager".
Data integrity
- HighDeletes with no soft delete or audit trail
In a test account, create a record in the app, then delete it using the app's own button.
- HighNo backup that has ever been restored
Open your database provider's dashboard and find the backups page (Supabase: Database, then Backups; Replit: the Database tool, then restore options).
- HighRace conditions on counters and balances
Open the app in two browser tabs signed in to the same test account that has a limited balance, seat count or single-use coupon.
- MediumTimestamps stored without a time zone
In a test account, create a booking or event for a specific clock time tomorrow and note it.
Performance
- MediumNo index on the columns you filter by
In the Supabase dashboard open Advisors, then Performance Advisor, and read the list of suggestions.
- MediumOne database query per list item
Open a page in your app that shows a list (orders, projects, customers) in Chrome, press F12, choose the Network tab and filter by "Fetch/XHR".
- MediumList endpoints that return everything
Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
- MediumWhole table downloaded, filtered in the browser
Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
Questions
replit security checklist
The list above: 40 checks across 9 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.
can i use this checklist without buying anything
Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.
Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.