Replit app security: secrets, sharing and what to check before you publish

Abstract render of a metal key dissolving into orange particles that flow into a dark glass vault

By the FixMyVibe team · Last reviewed 16 October 2026

On Replit, keep every API key, token and database URL in the Secrets tool, never in your files: secrets are encrypted and reach your app as environment variables, while file contents travel with every copy of the project. Before you publish, set the production secrets, choose who can access the app, and scan the code for keys that slipped into files.

Scan my repo free (read-only)See an example report

How Replit handles secrets

Replit's Secrets tool encrypts API keys, tokens and connection strings and makes them available to your project as environment variables, so you don't have to hard-code them. Replit also warns you when you paste something that looks like a secret into a file (its Secret Scanner) and offers to store it as a Secret instead.

The typical risks

1. A key in a file instead of in Secrets

The Secrets protections only cover values stored in Secrets. Replit's visibility table shows, for example, that someone remixing your project from its cover page sees your secret names but not their values. A key typed into a code file or .env file has no such protection: it is part of the files. The Secret Scanner helps when pasting, but it works on known key patterns and can be dismissed.

2. Who can access the app and project

Replit lets you publish an app as Public, Password protected, Workspace only or Invite only. Collaborators and organization owners can see secret values; non-owner organization members see only names. Review both before launch.

3. Missing or mixed-up production secrets

Deployment secrets are shown in the Publishing pane; Replit's docs say they sync from your development environment when you publish. Check which keys production actually uses (ideally separate production keys), and remember secrets are not available to Static Deployments, so a static frontend must never need a private key.

4. Open database rules

If your Replit app talks to Supabase from the browser, its public key is only as safe as your RLS policies. See the Supabase RLS check.

What the free FixMyVibe scan checks

Paste the URL of a public GitHub repository. The free scan reads the code read-only on a temporary copy that is deleted afterwards, and looks for:

  • Hardcoded secrets in the current files: API keys, tokens, Supabase secret/service_role keys, private keys, and secrets exposed through NEXT_PUBLIC_/VITE_ variables or committed build output.
  • Supabase database rules in your committed SQL migrations: tables without RLS, USING (true)/WITH CHECK (true) policies, policies that trust user_metadata, and similar patterns.

What it does not do: it does not scan your git history (only the current files), it does not connect to your database or your live Replit app, and it cannot see private repositories. Dependency checks against the OSV vulnerability database are part of the paid audits, not the free scan. It is an automated code scan, not a penetration test.

Pre-launch checklist

  1. Move every key, token and connection string into Secrets; remove them from code and .env files.
  2. Rotate any key that was ever in a file someone else could copy.
  3. Check the deployment secrets in the Publishing pane and use separate production keys.
  4. Choose the right access level for the published app and review your collaborators.
  5. If you use Supabase, check RLS on every table.
  6. Push to GitHub with the Git pane and run an independent scan of the repository.
Scan my repo free (read-only)See an example report

FAQ

Are Replit Secrets visible to other people?

It depends on how they reach the project. Replit's docs list it per access method: cover-page visitors see neither names nor values; people who remix a project they don't own see secret names but not values; multiplayer collaborators see both.

Is it safe to put an API key in a .env file or a code file on Replit?

Not if anyone else can get a copy of the files. Replit's guidance is to use the Secrets tool instead of hard-coding secrets: it encrypts them and exposes them to your app as environment variables.

Do my secrets work in the published app?

The Publishing pane has its own deployment secrets; Replit's docs say they sync from your development environment when you publish. Check there which values production actually uses. Replit's docs also say secrets aren't available to Static Deployments.

Can FixMyVibe scan my Replit project?

Yes, if you push it to a public GitHub repository, for example with Replit's Git pane. The free scan reads the repository only; it does not connect to your Replit app or database.

Sources

FixMyVibe is an automated code scan, not a full penetration test, and cannot guarantee that an app is secure. What happens to your code during a scan: see our privacy policy.