Is my Replit app safe to launch?

What Replit already does for you

• Replit's Publishing tool suggests a .replit.app address. You can connect a custom domain after publishing.
• The Secrets tool encrypts API keys and makes them available to your code as environment variables. Secrets aren't available to Static Deployments.
• Your published app gets its own production database, separate from the one you build with. The file system in a published app resets every time you publish.
• Replit runs a security scan before publishing, and a setting can block publishing when it finds a critical issue. The Security Center also offers dependency scans and deeper Agent security scans.

Replit's scans look at your code and packages. Throttle Bird looks at the published site from the outside: what a visitor's browser receives, your headers, HTTPS, link previews, and whether your data answers a stranger.

6 checks before you share the link

1. 1. Every key is in Secrets, none in code

   Why it matters: A key typed into your code can end up in the page or in a shared copy of your project.

   How to check: Open Tools → Secrets. Then search your code for anything that looks like a key (sk-, sk_live_, and similar).

   Fix prompt to paste into Replit

   Copy prompt

   Find every API key, token, or password written directly in the code. Move each one into Replit Secrets and read it from an environment variable on the server only. Make sure no secret is sent to the browser.

2. 2. Production settings match your live app

   Why it matters: Replit's troubleshooting guide lists missing production secrets, login callback URLs, and payment webhook URLs as common reasons published apps break.

   How to check: Open Publishing → Adjust settings and review Production app secrets. Then check that your login and payment settings point to your .replit.app or custom domain, not the dev URL.

   Fix prompt to paste into Replit

   Copy prompt

   List every place my app uses a URL for login callbacks, OAuth redirects, payment success/cancel pages, or webhooks. Make sure each one uses my published domain, not the replit.dev development URL.

3. 3. Data goes in the database, not files

   Why it matters: A published app's file system resets on every publish, so anything saved to a file disappears.

   How to check: Ask Agent where user data and uploads are stored.

   Fix prompt to paste into Replit

   Copy prompt

   Check whether the app saves any user data or uploads to local files. Move that data to the database (or an object storage service) so it survives republishing.

4. 4. Run a security scan before you share

   Why it matters: Replit's scans catch vulnerable packages and code issues before strangers do.

   How to check: Open Security Center from the Tools pane, run a scan, and fix the critical findings. Consider turning on Block publishing of critical vulnerabilities.

   Fix prompt to paste into Replit

   Copy prompt

   Review the findings in Security Center, fix every critical and high one, and explain any you think are false alarms.

5. 5. Endpoints check who's calling

   Why it matters: An endpoint with no login check lets anyone read other users' data or run up your API bill.

   How to check: For each route your app exposes, ask: what does a logged-out stranger get?

   Fix prompt to paste into Replit

   Copy prompt

   Go through every API endpoint. Each one that reads or changes user data must check the signed-in user on the server. Add rate limiting to endpoints that call paid APIs or send email.

6. 6. Titles, previews, and security headers

   Why it matters: Your link should look finished when shared, and headers block common browser attacks.

   How to check: Text your link to yourself to check the preview, and run the free scan for headers.

   Fix prompt to paste into Replit

   Copy prompt

   Add a unique title, meta description, and Open Graph tags with a 1200x630 image to every page. Also add security headers: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

What the free scan checks on your live Replit app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• If your page already exposes its Supabase or Firebase settings, one read-only test with the public key to see if a stranger can read your tables. Rows are never stored.
• Missing security headers that block injected scripts and click-jacking.
• A rate-limit hint on up to two /api/ routes found in your code (one normal request each, not a load test).
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your Replit project, so it doesn't replace testing sign-up and payments yourself.

Scan my Replit app free

Questions

Can I scan a .replit.app or replit.dev link?

Yes, if it's publicly reachable. Your published .replit.app or custom domain is the best one to check.

Does Throttle Bird replace Replit's security scan?

No, use both. Replit scans your code and packages. Throttle Bird checks what your live site actually sends to visitors.

Does the scan change anything?

No. It only reads public pages. It never logs in, submits forms, or writes data.