A Replit app — especially one built with Replit's Agent — can go from prompt to a publicly reachable URL in minutes, which means it's also publicly reachable before anyone has reviewed what got shipped. The most common exposure on Replit-hosted apps is secrets left in code or in a .env file that's served alongside the app instead of being excluded from the public deployment.
Replit's core workflow — build and get a live URL immediately — is exactly what makes it useful for fast iteration, and exactly what means a security review has to be something you do deliberately, since nothing in the default flow forces a pause before the app is public.
Common issues in Replit apps
Secrets in code instead of Replit's Secrets manager
Replit provides a dedicated Secrets tool for storing keys outside your code — but a generated or hand-added integration that reads process.env directly still ships that key to the browser if it's called from client-side code, regardless of where the value is stored.
.env or config files served publicly
If a Repl's deployment serves the project directory rather than a proper build output, a .env file can end up directly reachable at a public URL.
No security headers on the deployed app
Replit deployments don't add CSP, HSTS, or clickjacking headers automatically — like most fast-deploy platforms, that's left entirely to the app itself.