For Replit builders
Security audit for Replit Agent apps before you launch
Replit Agent builds and hosts the whole app, database included. It is fast, and it also makes decisions about auth and data access that you never see. The most common issue in the Replit apps we audit is an API that checks whether you are logged in but not whether the record is yours.
Push the Repl to GitHub, paste the URL, and get a launch-readiness score plus a fix prompt per finding.
Scan your Replit app now — free, under a minute, no signup
Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.
What Replit apps usually ship with
From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.
Routes require a session and then serve any record by id.
Keys that started in Replit Secrets sometimes end up hardcoded when the agent 'fixes' an env error.
IDs, amounts and roles come straight from `req.body` into the database.
Email, SMS and AI calls exposed without limits.
Read before you launch
- Missing ownership checks (IDOR): reading and editing other users' data · coming soon
- Secrets committed to the repo and hardcoded credentials · coming soon
- Trusting the client: prices, roles and scores sent from the browser · coming soon
- Unbounded AI endpoints: paying for someone else's prompts · coming soon
FAQ
- My Repl is not on GitHub.
- Replit has a built-in GitHub export (Git pane → Connect to GitHub). Push once, then paste the repo URL here.
- Does it scan the Replit database?
- No. It reads your code, schema and migrations. Nothing connects to your running app.