Replit app security

Replit’s Secrets docs say hard-coding credentials can expose them when a project is public, remixed, or shared. The Secrets tool stores values as environment variables so they are not written into those files. That helps when server code reads the variable. A value interpolated into client-side JavaScript, or stored under a NEXT_PUBLIC_ or VITE_ name, is still in the published bundle. Next.js inlines NEXT_PUBLIC_. Vite exposes VITE_ to client code. Source: Replit Secrets.

The same page distinguishes secrets from configurations, and it points at production app secrets for the published app. This check does not open that pane. If a key is in the HTML or a script, it is already public, whether or not a secret of the same name exists in the editor.

If the app uses Supabase, missing row level security is invisible to a passive fetch. Public .js.map files and missing security headers are visible, because they are part of what the site sends.

The free Quick Check fetches the public HTML, same-origin JavaScript, security headers, cookie flags, and whether the URL stays on HTTPS. It also requests seven fixed paths: /.env, /.env.local, /.env.production, /.git/config, /.git/HEAD, /.aws/credentials, and /.npmrc. Source maps named by those scripts are included. Matched secrets are masked. The free page writes the fix for the single most serious finding.

It does not query tables. It does not test row level security. It does not log in, brute force, fuzz, or enumerate paths beyond that list. An anon Supabase key in the bundle is client configuration. A service_role key in the bundle is a finding. Neither one tells you whether policies exist.

The €19 Launch Report opens the rest of that same pass. It does not scan anything new. Monitor, €9 per month, repeats the same passive check each week and when a deploy hook fires. It will not notice a table with row level security off.

Run the free check on the published URL. The editor preview is a different environment.

Rotate anything the report shows. Put server credentials in Replit’s Secrets tool, and confirm the published app is serving the values you intend. Replit’s Secrets page documents production app secrets under Publishing. Do not give them a NEXT_PUBLIC_ or VITE_ prefix, and do not paste them into client code.

Then fix source maps and headers on the deployment, and confirm Supabase row level security yourself.

If a .js.map file is public, turn off maps that ship to browsers, or keep stack traces without serving the files. In Vite set build.sourcemap to 'hidden' (or false to omit maps). In webpack set devtool to 'hidden-source-map'. In Next.js leave productionBrowserSourceMaps off, which is the default. Upload the maps to your error tracker in CI, then delete the .map files from the deploy output. A hidden map is still public if the file is deployed beside the script. Vite documents 'hidden' as a map file without the sourceMappingURL comment. Webpack documents hidden-source-map the same way. Next.js documents that production browser source maps stay off unless you opt in.

Missing headers are fixed on the host that serves the published URL. The check looks for Content-Security-Policy, Strict-Transport-Security on HTTPS, clickjacking protection (X-Frame-Options or CSP frame-ancestors), X-Content-Type-Options, and Referrer-Policy.

If the app uses Supabase, open the RLS check and the 30 October grant note. Confirm row level security and the GRANT yourself. Disabling RLS is not the fix for a missing grant. This scan does not query tables, so it cannot do that confirmation for you.