- Replit has a Secrets tool for keys. A key pasted into code instead is the classic slip.
- Apps can be Public, Password protected, Workspace only or Invite only, so check which one you chose.
- Static publishing cannot use Secrets, so a key that has to be in the page is exposed.
- Replit has its own security tools. A second, outside check is quick and free.
What Replit is and how its apps are deployed
Replit is a hosted AI app builder you use in the browser, as a desktop app or on mobile. Its apps used to be called Repls and are now called Replit Apps. Making an app live is called Publishing, and Replit hosts it for you. Publishing comes in types: Autoscale (the default), Static, Reserved VM and Scheduled. Replit provides a managed PostgreSQL database with separate development and production databases. The Git pane lets you connect a GitHub repository and push and pull code.
Common security issues in Replit apps
These are patterns that are common in AI-built apps, not claims about any one app. The rating is what LetMeCheck would typically give the issue (Critical, High or Medium).
- CRITICALCHECK: SECRET KEYS SAVED IN CODE
1. A key pasted into code instead of Secrets
What it is: Replit has a Secrets tool for storing keys outside your code. A key typed into a file is an exposed API key, and it goes wherever the code goes.
Why it happens here: Pasting a key into a prompt or a file is quicker than opening Secrets. Replit’s docs say to store credentials in Secrets and keep them out of chat prompts, and warn about checking code into a public repository.
How bad it can get: Anyone who sees the code can use the key. If it is a payment or AI key, the bill is yours.
- HIGHCHECK: PAGES AND ROUTES THAT SKIP THE LOGIN CHECK
2. An app set to Public when it should not be
What it is: Every app has a visibility setting. Public means anyone with the address can open it, including pages meant for you or your team.
Why it happens here: Replit’s docs say apps in a personal workspace default to Public and that you are responsible for picking the right visibility. It is easy to leave the default.
How bad it can get: An admin page with no login check is open to the internet. Early data and test accounts are visible.
- HIGHCHECK: SECRET KEYS SAVED IN CODE
3. A .env or config file that escapes into the open
What it is: A settings file with keys in it ends up in the app’s files or in a public repository. See exposed .env files.
Why it happens here: Replit’s Secrets tool can edit secrets in a bulk .env format, so .env files feel familiar, and one created in the project’s files is easy to commit by accident. Replit’s docs also warn that a Git credential kept as a secret can be reached by anyone with access to the app.
How bad it can get: The same as any exposed key, plus the file is easy to find because everyone knows its name.
- CRITICALCHECK: WHO CAN READ AND CHANGE EACH DATABASE TABLE
4. Database connection details that give too much away
What it is: The app’s database connection string is a powerful credential. If it leaks, or the app’s own API lets any visitor read every row, the data is open.
Why it happens here: Replit’s docs say to use environment variables for database access. Using them correctly is up to the app. A route that returns whole tables is a common shortcut in a first build.
How bad it can get: Customer data can be read or changed by anyone who finds the route or the string.
- HIGHCHECK: PAGES AND ROUTES THAT SKIP THE LOGIN CHECK
5. Routes that never check who is asking
What it is: A route is a web address your app answers. With no login check on the server, anyone can call it directly. An open route can also allow calls from any website unless CORS is set up carefully.
Why it happens here: The screen checks the user, and the route behind it does not. This is common in AI-built apps on every platform.
How bad it can get: Data can be read or changed with no account at all.
- HIGHCHECK: SECRET KEYS SAVED IN CODE
6. Production secrets missing, or the wrong publishing type
What it is: A key that works in the workspace may not be set for the published app. Static publishing cannot use Secrets at all.
Why it happens here: Replit’s docs say Secrets are available for all publishing types except Static, and its Publishing settings include a “Production app secrets” step. If a build fails without a key, the quick fix is to type the key into the code.
How bad it can get: The key moves into the code or the page, where it can be read.
- MEDIUMCHECK: PACKAGES WITH KNOWN SECURITY HOLES
7. Packages with known holes
What it is: Open-source packages whose installed version has a publicly known hole.
Why it happens here: Replit runs dependency scans and has a Package Firewall that guards against package names an AI invented. A version chosen long ago can still carry a known hole.
How bad it can get: Usually lower than a leaked key, but known holes are easy for attackers to look up.
How LetMeCheck checks a Replit app
Quick check: give it your published address (the Replit one or your own domain). It looks at the live site from the outside and can flag things any visitor can see, such as a key sitting in the page code. It is free, read-only and needs no sign-up.
Full check: this needs your code. Use the Git pane to push the Replit App to a GitHub repository, then connect that repository to LetMeCheck with read-only access. It reads the code for secret keys (including ones deleted since but still in the history), who can read and change each database table, packages with known holes, and routes that skip the login check.
Each fix prompt is written to be pasted into Replit’s Agent or chat. It says which file to change and what to leave alone. Review the change, republish, and run the check again to confirm.
The quick check is free, needs no sign-up and is read-only. See pricing for what the paid plans add, or try the free website audit now.
Example report entry
EXAMPLE, NOT A REAL CUSTOMER RESULT
A secret key is saved in your code
A key for a payment service is typed into a file instead of being kept in Secrets. Anyone who sees the code can use it. This is a made-up example to show the format of a report entry.
In my Replit App, the payment key is hardcoded in server/pay.js. Move it into Secrets, read it from an environment variable, remove it from the code and tell me which key I should replace because it has been exposed.
5 steps to harden a Replit app before launch
- 1Search your project for any key or token typed into a file. Move each into Secrets and rotate the ones that were in code.
- 2Open the visibility setting on every published app and pick Password protected or Invite only for anything that is not ready for the public.
- 3Check the Publishing settings: production secrets are set, and the publishing type supports Secrets (not Static, if you need one).
- 4Make sure every route that returns or changes data checks the signed-in user on the server.
- 5Push to GitHub, run the full check, fix what it finds, and run it again.
When to get a developer
If your app holds customer data, or a key has already been public, a person is worth it. A vetted developer who knows Replit can move secrets, lock down routes and give you a fixed quote before work starts. LetMeCheck re-checks afterwards. See hire a developer.
Frequently asked questions
Are Replit apps public by default?
Replit’s docs say apps in a personal workspace default to Public, and that you choose the visibility. Options include Public, Password protected, Workspace only and Invite only.
Should I put API keys in Replit Secrets?
Yes. Secrets keeps keys out of your code. A key typed into a file is an exposed API key if the code is shared or published.
Can I use Secrets with a Static publishing type?
Not according to Replit’s docs: Secrets are available for all publishing types except Static. If your app needs a key, choose a type that supports Secrets.
Does LetMeCheck need my Replit login?
No. The quick check needs only your live address. For the full check, push your Replit App to GitHub and give LetMeCheck read-only access to that repository.
How is this different from Replit’s own security tools?
Replit has its own scanners and a Package Firewall. LetMeCheck is a separate, outside check with plain-English explanations and fix prompts. You can use both.
Check your Replit app now
Run the quick check on your live site in about a minute, with no sign-up. Connect GitHub (read-only) when you want the full check.
Other platforms
Sources
- Replit (checked 2026-11-03)
- Replit docs: Secrets (checked 2026-11-03)
- Replit docs: Publishing overview (checked 2026-11-03)
- Replit docs: Deployment types (checked 2026-11-03)
- Replit docs: Private deployments and visibility (checked 2026-11-03)
- Replit docs: Shared responsibility model (checked 2026-11-03)
- Replit docs: Security overview (checked 2026-11-03)
- Replit docs: Package Firewall (checked 2026-11-03)
- Replit docs: SQL database (checked 2026-11-03)
- Replit docs: Git interface (checked 2026-11-03)
- Replit blog: Repls are now Replit Apps (checked 2026-11-03)
Platform behaviour changes fast. Last reviewed: . Spotted something out of date? Tell us.