Replit app security: check your deployment from outside

Why Replit apps differ

A Replit project is usually an Express, Flask or similar server plus a frontend, deployed to a *.replit.app domain or your own. Replit has a Secrets panel that injects environment variables into the server process, and that is the right place for keys. Problems start when the code ignores it: a key hard-coded in a frontend file, or a static file handler that serves the project root, including files that were never meant to be public.

Gaps we look for on Replit apps

• A static handler pointing at the project root, which can expose .env, package.json, server source or a .git folder.
• Keys copied into frontend code instead of being read from Secrets on the server.
• Verbose error pages or a /debug route left on in production, revealing stack traces and file paths.
• Missing security headers and permissive CORS on the API.
• A database admin tool or API docs endpoint that is reachable without login.

Replit includes its own security scanner for projects. It is a useful inside view. Shypset adds the outside view of the deployed site on its real domain.

What Shypset checks on a Replit app

We recognise Replit hosting from the Replit domain, the X-Replit-Request-Id response header or Replit references in the HTML.

Public checks run on every scan: secrets in the page and its scripts, source maps, response headers, cookies, CORS, TLS, DNS and email. After you verify the domain, the Verified checks request a fixed list of paths that should never answer, such as /.env, /.git/config, /server.js, /package.json, /phpinfo.php or /backup.sql. For any file that answers we report the path, status and size, and for config files only the key names, never the values.

Shypset is a passive external check. It does not log in to your app and does not test application logic such as SQL injection or IDOR, so a clean report means nothing is visible from outside, not that the app is secure.

Fixing it on Replit

Serve static files from a dedicated folder such as public/ or dist/, never from the project root. Move every key into Replit Secrets and read it from process.env or os.environ on the server only. Turn off debug mode in production. If a .env file was ever public, rotate every value in it, because you cannot know who downloaded it.

Example finding

A Verified finding from a Replit deployment, with its fix prompt.

URL: https://example.replit.app/.env
HTTP status: 200
Size: 412 bytes
Keys: DATABASE_URL, OPENAI_API_KEY, SESSION_SECRET

The deployed Replit app serves its .env file publicly. Change the Express static middleware so it serves only the ./public folder, add a rule that returns 404 for any path starting with a dot, and read DATABASE_URL, OPENAI_API_KEY and SESSION_SECRET from Replit Secrets. I will rotate all three values. List the files you changed.

Questions

Why are file checks only Verified?

Requesting paths the page never links to goes beyond what a normal browser does, so we only do it for domains whose owner has verified them.

Do you read the contents of exposed files?

We keep the path, status, size and, for config files, key names. Values are never stored or shown.