Security scan for Replit apps: what to fix before you deploy

The 6 most common issues in Replit apps

1. Keys written into the code. An API key pasted into index.js or main.py to get something working. Anyone who can see the code, or the git history, can use it. Replit's Secrets tool exists for this: it gives the key to your app as an environment variable without putting it in a file. See Exposed secrets & API keys.
2. Secrets in the frontend. If your app has a React or Vite frontend, anything in a VITE_ variable, or read in browser code, is shipped to every visitor. Keep paid API calls on the server.
3. Routes with no auth check. An Express or Flask route that updates, deletes or charges, and works when you test it signed in, but never checks the session. Anyone who finds the URL can call it. See Missing auth on admin routes.
4. No ownership check (IDOR). /api/notes/42 returns note 42 to any signed-in user, not just the one who wrote it. See IDOR.
5. SQL built from user input. A query written as `SELECT * FROM users WHERE email = '${email}'` or an f-string lets a visitor rewrite it. Use parameters instead. See SQL injection.
6. CORS open to every site. Allowing any origin together with cookies or credentials lets other websites make signed-in requests to your API. See CORS misconfiguration.

How to check your Replit app yourself

1. Search your files for sk_, sk-, key, secret and password. Move anything real into Secrets and rotate it, since it's already been exposed.
2. List every route that creates, changes or deletes data, and confirm each one checks the session and that the user owns the record.
3. Search for SQL written with +, template strings or f-strings, and switch those queries to parameters (? or %s placeholders, or your ORM).
4. Find your CORS setup and make sure it names your own domain, not *, if it allows credentials.
5. Run npm audit or pip-audit for vulnerable packages.

How to scan it with SetRepo

1. Get the code to SetRepo: connect your Repl to a GitHub repo and connect that repo to SetRepo (read-only access), or download the Repl as a zip and upload it. Add your deployed URL if the app is live.
2. Run a free Quick scan. It checks keys in your files and git history, routes that change data without a sign-in check, SQL built from strings in JavaScript, TypeScript and Python, CORS that allows any origin with credentials, and known-vulnerable packages. With your live URL it also checks HTTPS, security headers and the JavaScript the site serves for keys.
3. The free report shows every finding's title and severity, with full details for the top few. A Deep scan unlocks every finding with a fix prompt you can paste into Replit Agent.
4. A Deep scan also adds an AI review of access control and business logic: whether one user can reach another user's data, or a route trusts a price or plan sent from the browser.

FAQ

I moved my key into Secrets. Is it safe now?

Only if it was never committed. A key that was in a file stays in your git history, and anyone who can read the repo can find it there. When you connect a repo, SetRepo checks the last 100 commits of the default branch for keys, not just the current files. A zip upload has no history, so only its files are checked. If a key was ever in the code, rotate it.

Does SetRepo change my Repl?

No. GitHub access is read-only, and SetRepo never connects to Replit itself. Your code is deleted when the scan finishes. The one exception: a zip from a finished Quick scan is kept for up to 24 hours so you can upgrade it to a Deep scan, then deleted. Details: Security.

Does it work with Python as well as Node?

Yes. The secrets, route access, SQL injection and dependency checks cover both JavaScript/TypeScript and Python, including Express, Flask and FastAPI routes. Each report lists anything it couldn't check. Details: Accuracy.

What does it cost?

The Quick scan is free with no credit card. A Deep scan is a one-time payment, and there are monthly plans if you scan often. See pricing.