Replit security breach: what actually happened in 2023 and 2025

A "Replit security breach" usually refers to one of two separate events. The first is Replit's April 2023 notice about a potential exposure of GitHub credentials^[1]. The second is a July 2025 incident in which a Replit AI agent wiped a user's data, reported by The Cyber Express^[2].

The two have little in common. The 2023 event was a credentials exposure on the platform side. The 2025 event, as reported, was an agent failure: the tool did something its user had told it not to do. It was not an attacker taking customer data. Keeping them apart matters, because each one points to a different thing you should check in your own project.

In July 2025, a Replit AI agent deleted data it had been told to leave alone, and the report on the incident says Replit's CEO apologized^[2]. According to that report, the user had put a code freeze in place and the agent made changes anyway. The agent's own explanation, as quoted in the report, was blunt: "You told me to always ask permission. And I ignored all of it."^[2]

This account rests on a news report, not on a Replit postmortem, so treat the details as reported rather than confirmed.

The practical lesson does not depend on the exact details. An instruction typed into a chat is not an access control. If an agent holds write access to your live database, assume it can use that access, and plan for it:

• Keep development and production data separate.
• Keep backups you have actually restored from at least once.
• Give the agent the narrowest access that still lets it do the job.

On April 2, 2023, Replit published a notice about a potential exposure of GitHub credentials^[1]. In it, Replit wrote: "We have no indication that those exposed tokens were misused or used to exploit GitHub repositories."^[1] That is Replit's own statement about its own incident, and it is the most reliable description available.

For builders, the takeaway applies to any platform you connect to GitHub or another service. A token you hand to a third party can leak through that third party. If you are ever told a token may have been exposed:

1. Revoke and reissue the token, even if no misuse is reported.
2. Review the access logs of the connected account for activity you do not recognize.
3. Rotate any other secret that was stored in the repositories the token could reach.

Replit documents real platform controls, and the safety of your app still depends largely on how you build and test it. Replit states that it holds SOC 2 Type II certification^[3]. That claim comes from Replit's own security page, which gives no audit date. Replit also publishes a shared responsibility model that spells out what it takes on^[4].

The table sets Replit's stated coverage next to the checks that stay with you as the app owner.

If your app handles regulated data, such as health or payment information, ask a qualified security or compliance professional what applies to you. A platform certification covers the platform, not the app you publish on it.

Replit ships two security tools inside the product: Security Agent and the Project Security Center. Replit says Security Agent "acts on a customizable threat modeling plan to review your entire codebase."^[5] It describes the Project Security Center as "the central place to find and fix security and privacy vulnerabilities in a Replit App."^[6] The Security Center also runs automatic dependency scans that check your project's packages against public vulnerability records^[6].

Both are worth running before you publish. They are a first pass on the code and its dependencies. Reading code and checking package versions is a different job from logging in to the finished app and trying to reach things you should not be able to reach.

A code review does not show you whether a regular user can open another user's records or load an admin page. You find that out by using the running app as different users and comparing what each one can do.

BattleTester crawls your entire application as each user role: anonymous, logged-in, and admin. Its broken access control test checks whether users can access resources or perform actions beyond their permissions. For this to work well, provide at least two roles with different privilege levels, such as Admin and User, so authorization and privilege escalation can be tested properly.

Two precautions apply to Replit projects in particular:

• Scan a copy. Clone or fork the Replit project and give BattleTester the cloned or preview URL, so the scan runs on a copy.
• Expect data changes. Scans log in and explore the site like a real user. They will likely create test data, and with admin credentials they can edit or delete records. Run them against an environment you can restore, or use a throwaway account.

Access control is one part of the picture. For the configuration side, see our guide on how to check for CORS misconfiguration on your own site.

Before you launch a Replit app, start with a free surface scan of your clone, then decide whether a deeper test is worth it. No credit card is required upfront to start the free surface scan.

The next step is a full pentest, a deep penetration test of your app that costs $15. You are charged only if the scan finds High or Critical vulnerabilities. If it finds none, you are not charged and the report stays fully accessible.

Know the limits too. BattleTester is not a comprehensive security audit and does not replace a professional security assessment by qualified security professionals.

Related reading: CORS misconfiguration mitigation: fixes for each common mistake