A Replit app, especially one built with Replit's Agent, can go from prompt to a publicly reachable URL in minutes, which means it's also publicly reachable before anyone has reviewed what got shipped. The most common exposure on Replit-hosted apps is secrets left in code or in a .env file that's served alongside the app instead of being excluded from the public deployment.
Why this happens in Replit apps
Replit's core workflow (build and get a live URL immediately) is exactly what makes it useful for fast iteration, and exactly what means a security review has to be something you do deliberately, since nothing in the default flow forces a pause before the app is public.
Because the same environment that's used for development is often what ends up serving the deployment, files and settings meant purely for local iteration can end up reachable the same way the app itself is.
Common issues in Replit apps
What actually shows up on Replit-hosted apps:
- Secrets in code instead of Replit's Secrets manager: Replit provides a dedicated Secrets tool for storing keys outside your code, but a generated or hand-added integration that reads process.env directly still ships that key to the browser if it's called from client-side code, regardless of where the value is stored.
- .env or config files served publicly: if a Repl's deployment serves the project directory rather than a proper build output, a .env file can end up directly reachable at a public URL.
- No security headers on the deployed app: Replit deployments don't add CSP, HSTS, or clickjacking headers automatically; like most fast-deploy platforms, that's left entirely to the app itself.
How to fix it
Before sharing a Repl's link outside your own testing:
- Move any key currently read via process.env in client-callable code into a server-only route, and use Replit's Secrets manager for storage either way.
- Confirm your deployment serves a proper build output, not the raw project directory. Try requesting /.env directly on the live URL to check.
- Add security headers at the app layer, since Replit's deploy step won't add them for you.
Frequently asked
Does using Replit's Secrets manager alone make a key safe?
It keeps the value out of your source code and version history, which matters, but it doesn't stop a client-side call to process.env from shipping that value to the browser. Where the code runs (server vs. client) still determines what's exposed.
How do I check if my .env file is publicly reachable?
Request the file directly at your deployed URL (e.g. yourapp.replit.app/.env). If it returns file contents instead of a 404, it's being served publicly and needs to be excluded from the deployment immediately, plus any secrets in it rotated.