Replit app security before launch
Before you launch a Replit app, put every key in Replit Secrets, make sure no key is sent to the browser, lock down your admin and API routes, and check who can see your code. Replit runs your server for you, which helps, but it cannot know which pages should be private.
Step-by-step checklist
- Move every key and password into Replit Secrets. Do not write them in code files.
- Check if your Repl is public. If it is, anyone can read the code. Make sure no secret was ever in it, and rotate any that were.
- Make sure your server never sends secret values to the page, even in error messages.
- Log out and visit every admin and API route. Each should ask for login.
- Check that each API route also checks who the user is, not only that they are logged in.
- Turn off debug mode and detailed error pages in your deployed app.
- If your database is reachable from the internet, use a strong password and limit access.
- Test your deployed URL, not only the preview. Settings can differ.
FAQ
Are Replit Secrets safe?
They keep keys out of your code. They do not help if your code sends the value to the browser.
My Repl was public with a key in it. What now?
Rotate the key in that service right away. Then move it into Secrets.
Does Replit Agent add login checks for me?
Sometimes. Do not count on it. Test each route while logged out.
Can DeployVet scan a Replit app?
Yes. Give us your deployed URL and prove you own it. The Free check is $0.
Check your app for free
DeployVet scans your live site from the outside, like a stranger would. You get a score and the worst issue with a fix.
DeployVet has three plans. The Free check is $0. A one-time Scan is $7. Pro is $15/mo and adds weekly scans and email alerts. For paid plans you pay first, then the scan runs.