How secure Replit is for sensitive code

On the free Starter plan, all Repls are public and visible to anyone. To keep your code private, you need a Core ($25/month) or higher plan. When creating a new Repl, toggle the visibility to Private. For existing Repls, open the Repl, click the three-dot menu near the title, select Settings, and change visibility to Private. Private Repls are only accessible to you and explicitly invited collaborators. This is the single most important security step for sensitive projects.

Never hardcode API keys, database passwords, or tokens in your source code. Open the Secrets tool from the Tools dock on the left sidebar (or search for Secrets). Add each credential as a key-value pair. Replit encrypts all secrets with AES-256 and transmits them over TLS. In your code, access secrets via environment variables: process.env.MY_SECRET in Node.js or os.getenv('MY_SECRET') in Python. Use the App Secrets tab for per-project secrets and the Account Secrets tab for credentials shared across projects.

1// Node.js: accessing a secret
2const apiKey = process.env.OPENAI_API_KEY;
3if (!apiKey) {
4  throw new Error('OPENAI_API_KEY is not set. Add it in Tools → Secrets.');
5}
6
7# Python: accessing a secret
8import os
9api_key = os.getenv('OPENAI_API_KEY')
10if not api_key:
11    raise ValueError('OPENAI_API_KEY is not set. Add it in Tools → Secrets.')

This is the most common security mistake on Replit: workspace secrets do not automatically carry over to deployments. When you publish your app, you must add secrets separately in the Deployments pane under the Secrets section. Without this step, your deployed app will crash because process.env.VAR_NAME returns undefined. This applies to Autoscale, Reserved VM, and Scheduled deployments. Static deployments do not support secrets at all.

When you invite collaborators to a private Repl, they can see both secret names and values. This is by design but may be a concern for sensitive credentials. Cover page visitors (people who see the Repl's public profile) cannot see secrets. Users who remix your Repl can see secret names but not values. Organization members without the Owner role cannot view secret values in the UI but can print them via code. Plan collaborator access carefully and rotate credentials when removing team members.

Search your entire codebase for accidentally committed secrets. Open Shell and use grep to find common patterns like API key strings, connection strings, or password assignments. If you find any, replace them with environment variable references and add the actual values to the Secrets tool. If your Repl was ever public, assume those credentials are compromised and rotate them immediately.

1# Search for common credential patterns in Shell
2grep -r "api_key" . --include="*.js" --include="*.py" --include="*.ts"
3grep -r "password" . --include="*.js" --include="*.py" --include="*.ts"
4grep -r "sk-" . --include="*.js" --include="*.py" --include="*.ts"
5grep -r "Bearer" . --include="*.js" --include="*.py" --include="*.ts"

Understand what Replit does not protect. The file system in deployments is ephemeral and resets on every publish, so do not store sensitive data on disk. Replit's AI Agent has access to your code and secrets during building sessions. The REPLIT_DEV_DOMAIN variable exists only in the workspace and should never be used in production code. Replit's infrastructure runs on Google Cloud Platform in the United States, which matters for data sovereignty requirements. Enterprise plans offer EU region selection and static IPs for compliance.