What Replit already does
- Looks over files Agent changes for risky patterns and keys written into the code.
- Checks your packages against public lists of known problems, for free, and checks again when a new problem is announced.
- On paid plans, a Security Agent reads your code, ranks what it finds by severity and helps fix it.
- Runs a scan before you publish.
What it leaves to you
Turn on the publishing block
“Block publishing of critical vulnerabilities” is a setting. Until it’s on, a critical finding is a warning, not a stop.
Read findings in your own code
Auto-Protect, when you switch it on, only patches packages. Problems in how your app checks who’s asking still need a decision from you or an engineer.
Republish after a fix
Your live app runs the last version you published. A repair in the workspace reaches users only when you publish again.
A quick self-check
- Open the Security Center from the Tools pane and clear anything marked Critical or High.
- Run our free outside scan on your published address to see what strangers can see.
- Sign up as two users and try to open one’s data while signed in as the other.
Sources (Replit’s docs)
When to ask a person
If a finding survives several rounds with Agent, if you can’t tell whether a change made things safer, or before payments and personal data go live. A scan reports patterns; a person can tell you whether one user can really reach another’s data.