ShipGuardScan a site

Replit Secrets & Deployment Security Checklist

Updated 2026-10-17

Replit's Secrets tool keeps values out of your source files, but a secret is only as private as the code that reads it. If a frontend file reads it, or the Repl is public with a committed .env, it leaks.

Server reads, client never does

Read secrets only in your backend process (process.env.X in Node, os.environ in Python) and expose narrow API routes to the frontend.

Check the public surface

If your Repl is public, anyone can view its files. Make sure no .env, credentials JSON or database dumps are committed, and that static file serving does not expose the project root.

curl -s -o /dev/null -w "%{http_code}\n" https://your-app.example/.env
curl -s -o /dev/null -w "%{http_code}\n" https://your-app.example/.git/config

Checklist

  • All keys in Secrets, none in files
  • Static server serves a build folder only
  • No .env or .git reachable over HTTP
  • API routes check authentication
  • Deployment uses HTTPS custom domain

Copy-paste fix prompt

Review this Replit project: list any hard-coded API keys, move them to Replit Secrets, make sure only the backend reads them, configure the static file server to serve only the build directory, and add a route-level auth check on every API endpoint.

FAQ

Are Replit Secrets visible to people who fork my Repl?

Replit's documentation describes how secrets are handled for forks and collaborators; review it for your plan and never rely on a public Repl to keep files private.

How can I check for an exposed .env?

Request /.env on your deployed URL. A safe app returns 404 (not your homepage HTML with a 200).

Check your deployed app in ~25 seconds

Free passive scan: leaked keys, Supabase exposure, public config files and headers.

Run a free scan

Related