How to run security checks in Replit

Open the Shell tab in your Replit workspace. For Node.js projects, run npm audit to scan all packages in node_modules for known vulnerabilities. For Python projects, install pip-audit first, then run it. Both tools check your installed packages against public vulnerability databases (the GitHub Advisory Database for npm, the Python Advisory Database for pip-audit) and report any issues with severity ratings from low to critical.

1# For Node.js projects:
2npm audit
3
4# For Python projects:
5pip install pip-audit
6pip-audit

For Node.js projects, run npm audit fix to automatically update packages to patched versions where possible. Some fixes require major version bumps that may introduce breaking changes — npm audit fix --force handles these but review the changes carefully. For Python projects, pip-audit suggests updated versions in its output. Update specific packages with pip install package==version. Always test your app after updating to make sure nothing broke.

1# Auto-fix Node.js vulnerabilities:
2npm audit fix
3
4# For breaking changes that need major updates:
5npm audit fix --force
6
7# For Python, update specific packages:
8pip install requests==2.31.0

Open Tools in the left sidebar and click Secrets. Verify that all API keys, database credentials, and tokens are stored here — not hardcoded in your source files. Search your code files for common patterns like 'sk-', 'api_key =', 'password =', or 'Bearer' to find any credentials that may be embedded directly in code. Move any found values to Secrets and replace them with os.getenv() or process.env references. Remember that collaborators can see Secret values, and remixers can see Secret names but not values.

1# Python — correct way to access secrets:
2import os
3api_key = os.getenv("API_KEY")
4
5# Node.js — correct way to access secrets:
6const apiKey = process.env.API_KEY;
7
8# WRONG — never do this:
9api_key = "sk-abc123..."  # Hardcoded secret!

To catch vulnerabilities automatically before every deployment, add an audit step to the build command in your .replit file. Open .replit (enable Show hidden files if needed) and modify the deployment build command to run the audit before building. Using npm audit --audit-level=high makes the build fail only for high or critical severity issues, so minor advisories do not block deployments unnecessarily.

1# .replit
2[deployment]
3build = ["sh", "-c", "npm audit --audit-level=high && npm run build"]
4run = ["sh", "-c", "node index.js"]
5deploymentTarget = "cloudrun"

Beyond dependency scanning, review your code for the most common web application security issues from the OWASP Top 10. In Replit projects, the most relevant issues are: injection attacks (always use parameterized queries for database operations, never string concatenation), broken authentication (validate tokens server-side, not just client-side), and sensitive data exposure (use HTTPS-only, store secrets properly). These are manual checks, but knowing what to look for prevents the most common security failures.

1# WRONG — SQL injection vulnerability:
2cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
3
4# CORRECT — parameterized query:
5cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
6
7# WRONG — client-side only auth check:
8if (localStorage.getItem('isAdmin')) { showAdminPanel(); }
9
10# CORRECT — server-side validation:
11// Validate the user's token on every API request server-side