Security check for Replit apps
Your Repl runs a real server. Check what it serves.
Replit Agent builds the backend too, so more than the page can end up public. Paste your replit.app or custom domain: we look at it from outside, explain each issue in plain English and give you a prompt Replit Agent can use to fix it.
First scan is free, no signup and no code access. By scanning you confirm you own this site or are authorized to test it, and agree to the Terms and Privacy Policy.
One key needs rotating before launch.
Built with Replit Agent · Express · Node.js
- Issues
- 5
- Hardening
- 7
- Checks
- 108
- CriticalSupabase service key is readable in main.jsJS bundle
- HighSource map publishes your src/ folderSource maps
- MediumAnyone can send email as your domainDMARC
- MediumSession cookie set without SecureCookies
- LowNo Content-Security-Policy headerHeaders
Passive external check; application logic (SQLi, IDOR) is not tested.
- checks across headers, TLS, DNS, email and supply chain
- 100+
- secret patterns searched in your JavaScript and source maps
- ~40
- for the first scan, no signup and no code access
- $0
A real server answers more than the page.
The project folder went public
A static handler pointed at the project folder instead of the built frontend serves whatever sits next to it:
server.js,package.json, sometimes a.env.The key skipped Secrets
Replit Secrets keeps keys on the server. A key pasted into a frontend file to make a call work ships to every visitor instead.
Development mode went live
Deployed without production settings, an Express or Flask server can answer an error with a stack trace, file paths included.
What a stranger sees when they open your Replit app.
01The serverPublic
We see that it runs on Replit
A replit.app address or the X-Replit-Request-Id header tells us where the app runs, so the fix prompts are written for Replit Agent.
response headers
HTTP/2 200content-type: text/htmlx-powered-by: Expressx-replit-request-id: 3f9c…
02The scriptsPublic
A key that skipped Secrets
Replit Secrets keeps keys on the server. A key pasted into a frontend file ships to every visitor, and we find it in the page and its scripts.
Report
CriticalOpenAI API key found in your JavaScriptsk-proj-…Lm2 in /assets/index-4f1d.js03The error pageVerified
A missing page answers with a stack trace
After you verify the domain (free), we ask for a page that does not exist. If a stack trace comes back, anyone can read your file paths and framework.
GET /a-missing-page · 404
Error: ENOENT: no such file or directory, stat '/home/runner/workspace/dist/a-missing-page' at SendStream.error (…/send/index.js:270:31) at onstat (…/send/index.js:727:10)
04The fixPublic
A prompt for Replit Agent
Each finding comes with a prompt for the tool you build with. Paste it into Replit Agent, redeploy, rescan.
Fix prompt for Replit Agent
The deployed server shows stack traces on error pages. Run the deployment with NODE_ENV=production, add an Express error handler that answers with a short message and no stack, then redeploy and confirm a missing page shows no file paths.
Example data. Values in the table check are hidden.
What we check on a Replit app
Where full-stack Replit apps leak most often. Public checks run on every scan; Verified ones after you prove the domain is yours.
Files your server should not serve
.env files, .git, server.js, package.json, SQL dumps and database tools such as Adminer. We keep the path, status, size and key names, never the values
After you verify
Keys outside Replit Secrets
About 40 key patterns, such as OpenAI, Anthropic, Stripe and database connection strings, in your page, its scripts and published source maps
Public
Stack traces on error pages
We request a page that does not exist and look for a stack trace or server file paths in the answer, a sign that debug output reached production
After you verify
Headers and CORS on your server
Content-Security-Policy, HSTS and framing protection, and a CORS policy that lets any site read your responses
Public
How it works
From URL to fixed in four steps.
Paste your URL
No code, no login, no setup. The first scan takes about a minute.
Read what a stranger could do
Each issue is explained by its consequence, in plain English, ranked by severity.
Fix with Replit Agent
Copy the fix prompt for the issue and paste it into Replit Agent.
Rescan and confirm
Verify your domain for free to unlock the deeper checks, then rescan to see the issue gone.
Free first scan. No signup, no code access.
Before / after
One static folder, before and after.
Point the static handler at the project folder and the server hands out the files next to your app, its own code included. Serve the built frontend instead.
HighYour server source code is downloadableVerified check
const app = express(); app.use(express.static(__dirname));app.listen(process.env.PORT || 3000);
High: GET /server.js returns this file.
The deployed server serves the project folder, so /server.js and /package.json can be downloaded. Change express.static to serve only the built frontend folder (dist), keep server code and config files outside it, then redeploy and confirm /server.js no longer returns the source.
An example. Each finding in the report comes with a prompt like this.
Inside the report
A finding, and the prompt for Replit Agent.
Every issue comes with a prompt written for the tool you build with. Paste it into Replit Agent, redeploy, and rescan to see the finding gone.
Replit security guideCritical
Your .env file is downloadable
Anyone can download it, with your database URL and API keys. Treat every value in it as leaked.
GET /.env returned 200 · keys DATABASE_URL, OPENAI_API_KEY, SESSION_SECRET
The deployed app serves its .env file at /.env. I will rotate DATABASE_URL, OPENAI_API_KEY and SESSION_SECRET. Find what serves the file, make the server serve only the built frontend folder, return 404 for any path that starts with a dot, and read the three values from Replit Secrets on the server. Delete the .env file, redeploy, and confirm that /.env returns 404.
Compared
Not instead of your other checks. Next to them.
| What | Shypset | Replit’s built-in scan | Manual pentest |
|---|---|---|---|
| Where it looks | Your live site, from outside | Your project, from inside | Your app, by a security tester |
| Headers, TLS, DNS, email | Checked on every scan | Not covered | Usually covered |
| Works for any stack or host | Yes | Only apps built in Replit | Yes |
| Logged-in logic (IDOR, per-user rules) | Not tested | Deeper inside the project | Yes |
| Cost and time | First scan free, about a minute | Free, inside the tool | Quoted per project, days to weeks |
Run the built-in scan too: it sees the inside. Shypset shows what a stranger sees.
One URL, the whole outside view.
- checks across headers, TLS, DNS and email
- 100+
- API key patterns in your JavaScript
- 40+
- free scans a month with an account
- 3
- lines of your code we need to see
- 0
A scan takes about a minute. Table and file checks run after free domain verification.
Pricing
Your first scan is free, no signup needed. Upgrade when you want the full report and fix prompts for every issue.
Free
For your first check before launch
$0/ month
- 3 scans per month
- 1 free rescan of each scan within 7 days
- Fix prompt for your top issue
- Security grade and severity breakdown
- OWASP Top 10 and CWE mapping
- 7-day history
Pro
For founders shipping AI-built apps
$15/ month
Billed monthly, $180 a year
- Up to 200 scans a month (fair use)
- 1-year history
- Full report for every issue
- Fix prompts for Cursor, Lovable, Claude and more
- HTML and Markdown export
- “Scanned by Shypset” badge for your verified domain
- Weekly monitoring with email alerts (verified domains)
Agency
For agencies and freelancers. Coming soon
Soon
- More domains for client projects
- Reports you can hand to clients
- Need more today? Contact us
Launch Pass
$9 one-time
One domain for 30 days: the full report and every fix prompt, plus 3 rescans. The public report and badge are not included.
Questions
Replit’s scan looks at the project from the inside. Shypset looks at the deployed app from outside, the way a visitor or an attacker does, on your replit.app or custom domain, including headers, TLS, DNS and email.
Yes, while only server code reads them. A key copied into a frontend file is public, and that is what the key check finds. We never see your Secrets or your code.
Yes. You cannot add DNS records there, so verification uses a meta tag on your home page. We give you a prompt for Replit Agent that adds it; redeploy and verify. It is free.
The first scan is free, with no signup and no code access. A free account gives you 3 scans a month. The full report and a fix prompt for every issue come with Pro or a one-time $9 Launch Pass.
Without verification we only read what any visitor’s browser can, plus public records such as DNS. Deeper checks, like asking your database tables for a row, run only after you verify that the domain is yours. Verification is free.
No. It is a passive external check: it does not log in and does not test application logic such as SQL injection or IDOR. A clean report means nothing is visible from outside.
Replit Agent built and shipped it.
We check what it left open.
Paste a URL and get the report in about a minute. First scan is free, no signup and no code access.
Ask the team behind the scanner.
Real people read every message. Tell us what you need and we will answer by email.
- Questions
- About a scan, a finding, or how a check works.
- Agency and team needs
- More domains, reports for clients, invoicing.
- Security concerns
- A vulnerability in Shypset, or a request not to scan your domain.
Prefer email? Write to info@softdoes.com.