Is Replit Safe?
Replit itself is a legitimate, widely used platform: it stores secrets outside your code and runs dependency scans on your project. The risk is what your deployment exposes. A secret referenced from client code, a .env file served from the web root, or a debug route left on is readable by anyone, and that is what this scanner tests.
Replit collapses the gap between writing code and putting it on the internet, so a project still carrying development conveniences - a config file in the web root, a value read straight into client code, a debug route left enabled - gets published exactly as it is. This scanner takes your deployment URL and checks what that project is now serving to anyone who asks.
What we check on a Replit deployment
Config and dotfiles served from the web root
Requests .env, .env.local, .env.production, .git/HEAD, .git/config, and common backup and dump filenames that static hosting will serve if nothing blocks them.
Secrets in the shipped JavaScript
Downloads your deployed bundles and matches them against key patterns for 30+ providers, plus generic SECRET, API_KEY, and DATABASE_URL assignments.
Read more →Debug and health routes left enabled
Probes paths like /debug, /api/env, /api/config, /api/internal, and /api/_admin to see which answer an unauthenticated request.
Verbose errors and version disclosure
Watches for stack traces returned to the browser, directory listings, and server headers that name your exact stack version.
Database reachable with a public key
If the app talks to Supabase or a Firebase Realtime Database, we test what those return using only the key present in your bundle.
Read more →Headers, cookies, CORS, and TLS
CSP, HSTS, and frame protections, cookie flags, wildcard or origin-reflecting CORS, certificate expiry, and mixed content.
Read more →How the Replit Security Scanner works
- Step 1
Paste your deployment URL
The public URL your Repl is served at, or your custom domain. No Replit login, no repl fork, no access to your Secrets pane, and no Ubserve account.
- Step 2
We request what the internet can request
We fetch the page, download the JavaScript it links to and scan it for provider keys, then request common config, backup, and debug paths to see which return content instead of a 404. We also read error responses, headers, cookies, and the TLS certificate, and test CORS by varying the Origin header.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
Is Replit safe to use?
Yes, as a platform. Replit keeps secrets in a Secrets store rather than your source, and its Security Center runs automatic dependency scans, with agent-based code review on paid plans. What Replit cannot decide for you is what your published app serves. A secret you read from client code gets inlined into the JavaScript every visitor downloads, and a public Repl shows its source to anyone. Safe to build on, then, but a deployment still needs checking from the outside.
Replit has a security scanner. Why use this one?
They look from opposite sides. Replit's Security Center reviews your project from the inside: the packages you depend on and, on paid plans, the code the agent wrote. This scan has no access to your project at all. It requests your deployed URL the way a stranger would and reports what comes back, which is how it catches a .env file your host serves or a key that survived into the bundle. Use Replit's scan before you ship and this one after.
How do I know if my Replit app is exposing secrets?
Try to fetch them yourself from outside the editor. Open your deployment URL with /.env appended in a private window - if you get key-value lines back instead of a 404, your host is serving that file to everyone. Then search the JavaScript your page downloads for the value of a secret rather than its name, since bundlers inline values at build time. Both checks take a minute by hand, and this scanner runs them alongside the rest of the public checks.
Are Replit Secrets safe to use?
Replit Secrets keep values out of your source files, which is the right place to start, but they solve storage rather than exposure. A secret is safe only while it stays server-side: read it in server code and it is fine, reference it from client code and your bundler will inline the value into the JavaScript every visitor downloads. Repl visibility is a separate setting worth checking, since a public Repl shows your source to anyone. This scan cannot see your Secrets pane; it checks whether the values ended up somewhere public.
How does the scanner work?
It runs the standard Ubserve public scan against your deployment URL. We fetch the page, download the JavaScript bundles it references and match them against provider key patterns, then request common dotfile, backup, and debug paths to see which return content. We also inspect error responses, security headers, cookies, CORS behaviour, and the TLS certificate. Every probe is a read against a public URL.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my Repl, my Secrets, or my source code?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Will scanning break my deployment?
No. Every request is a read against public URLs - no writes, no account creation, and no data modified. Probes go out a couple at a time with pauses between them, so a small Repl is not hit with a burst of traffic.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Exposed .env Checker
Requests the dotfiles, backups, and source maps your host might be serving, and checks whether env values reached the bundle.
Open tool →
AI BuildersBolt.new Security Scanner
Checks a deployed Bolt.new app for env values that reached the client bundle and endpoints that trust the browser.
Open tool →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →Keep reading
- Replit security checklistWhat to verify before a Repl becomes a product.
- How to remove exposed API keys from your frontendGetting a secret back behind a server route.
- I exposed an API key - what now?The rotation order that limits the damage.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
- Vibe coding security risksThe failure patterns that repeat across every builder.
Run the Replit Security Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.