Replit app security: what to check
Replit runs your app on a server it manages, whether you wrote the code yourself or Replit Agent built it. That means your own server code sends every response, so headers, cookies and CORS are yours to set.
Replit Secrets keep keys out of your code, but only if the code that uses them runs on the server and never sends them to the browser.
What to check on Replit
-
Are secret API keys exposed in your front end?
Keys stored in Replit Secrets are safe only while they stay in server code. A key written into a page or a front-end file is public.
-
Are your security headers set?
Your server sends the headers, for example with the helmet package in an Express app.
-
Are your cookies protected?
Session cookies set by your own server need Secure, HttpOnly and SameSite.
-
Can other websites read your pages? (CORS)
A permissive CORS setting copied from an example can let other sites read your responses.
-
Does your server announce its software versions?
Frameworks often announce themselves in an X-Powered-By header unless you turn it off.
Where settings go on Replit
- Security headers
- On Replit, set it in your server code, for example with the helmet package in an Express app, so every response carries it.
- Secret keys
- Store the key in Replit Secrets and use it only in your server code, never in files sent to the browser.
Common questions
Are Replit Secrets safe?
They keep keys out of your code and your repository. They do not protect a key your server sends to the browser, so use secrets only in server-side code.
Do I need security headers on Replit?
Yes. Replit serves what your app sends, so add the headers in your server code.