Fix your Replit app

Check Replit’s Security Center first

1. 1

   While you build

   Replit looks over the files its Agent changes for risky patterns and passwords or keys written into the code.

2. 2

   Package checks

   Free and automatic. Replit checks the packages your app uses against public lists of known problems, and checks again when a new one is announced.

3. 3

   Security scan

   On paid plans, Replit’s Security Agent reads your code, reports what it finds by severity, and helps fix it. A scan also runs before you publish.

Let Agent work through its findings first. Call in a person when a finding survives several attempts, or when you can’t judge whether a change made things safer.

What to know about Replit

• A critical finding only holds back publishing when the “Block publishing of critical vulnerabilities” setting is switched on. With it off, the app ships anyway.
• Auto-Protect starts switched off. Even when on, it patches third-party packages and never touches the code Agent wrote for you.
• Production keeps running the previous build until you republish, so a repair in the workspace isn’t what users see yet.

What we do

1. Write down what users see going wrong. No technical words needed.
2. One price, paid before work starts. Anything larger is quoted separately and waits for your yes.
3. Invite the engineer into the Replit App from your own account; they make the change there.
4. Test the result, then hit republish so production gets it.

Questions