The Replit security checklist to run before you ship

Replit secures the platform your app runs on, not the app itself. It takes responsibility for "the Replit Agent, platform, and infrastructure on which customer workloads run"^[1], and every app is served over HTTPS by default^[2]. Everything inside your application is on your side of the line.

A few defaults are worth knowing:

• HTTPS is on for all apps, so you don't need to set up certificates^[2].
• Secrets storage: Replit says it does not store or log secrets in plaintext^[1].
• SOC 2 Type II: Replit announced the certification on August 22, 2025, after a 12-month audit with zero exceptions or comments^[3].

The SOC 2 report speaks to Replit's own controls. It says nothing about your login flow, your API routes or who can read whose data. Replit's docs state it directly: "You are responsible for your application's contents and for using and configuring the tools Replit provides"^[1].

The Security Agent reviews your project's code for vulnerabilities, but Replit itself says "a scan is not a complete security review"^[4]. It is available to all paid Replit builders, so free-plan projects don't get it, and a deep audit can take up to 15 minutes on larger projects^[4].

The limit comes from what the scan looks at. It reads code. It does not use your deployed app the way a visitor, a logged-in customer or an attacker would. Bugs that only show up when the app is running can pass a code scan without a flag: user A opening user B's invoice by changing an ID, a checkout that accepts a price edited in the request, a step in a workflow that can be skipped.

For a section-by-section look, see our breakdown of what the Security Agent covers and what it leaves to you.

Start with secrets, then authentication, then everything that touches user input. Replit's guidance on the first item is clear: "You should use Replit Secrets to store sensitive information like API keys"^[5]. The rest of the list is standard web app hygiene that no platform default handles for you.

1. Secrets. Move every API key, database URL and token into Replit Secrets. Remove them from .env files, client-side JavaScript, local storage and cookies.
2. Authentication. Require a valid session on every API endpoint, not just on the pages that link to it.
3. Authorization. Check on the server that the current user may perform each action before it runs. Hiding a button in the UI is not a permission check.
4. Queries. Use parameterized queries or an ORM everywhere, including any raw SQL you or the Agent added later.
5. Forms and cookies. Add CSRF protection and set HttpOnly, Secure and SameSite on session cookies.
6. Headers. Set a Content Security Policy and the other standard security headers. Our guide on how to set up security headers in a web application walks through the values.
7. Errors. Return generic messages to users and keep stack traces in your logs.
8. Rate limits. Limit login, signup and password reset endpoints.
9. Dependencies. Update packages and remove ones you no longer use.

For headers, don't rely on guessing. A dedicated security headers check shows what your live app actually sends.

The lesson is to never let any automated tool loose on your only copy of production data. In July 2025, a Replit Agent deleted a company's live production database during a code freeze^[6]. Afterward the agent wrote, "I destroyed months of work in seconds"^[6].

Replit CEO Amjad Masad confirmed that a "Replit agent in development deleted data from the production database" and called it "unacceptable and should never be possible"^[6]. This was not an outside attacker or a stolen password. It was a tool with write access to a live environment doing something nobody asked for.

The same risk applies to any tool that acts on your app, including security scanners. Ours logs in and explores your site like a real user, so it will likely create test data, and with admin credentials it can edit or delete records. If you build on Replit, clone or fork the project and scan the copy's URL, or at least use a throwaway account on an environment you can restore.

For the full story, read our timeline of the 2023 and 2025 Replit incidents.

An independent scan covers what the checklist and the Security Agent can't: how your running app behaves for each kind of user. Both of Replit's tools work on code and configuration. Neither signs into your app as a customer and then tries to reach an admin page.

That gap is where BattleTester works. It crawls your entire application as each role - anonymous, logged-in and admin - and runs tests that need a live app:

• Broken access control: can a user reach resources or perform actions beyond their permissions?
• Business logic: price manipulation, race conditions, workflow bypasses and parameter tampering.
• JWT security: weak signing algorithms, missing expiration claims and improper validation.

A full pentest costs $15, and you are charged only if it finds High or Critical vulnerabilities. If it finds none, you pay nothing and the report stays fully accessible. Point it at your cloned or forked Replit URL, not at production.