Implement secure data handling on Replit: PostgreSQL, KV Database, Object Storage, and data security patterns.
Use when handling sensitive data, connecting databases, implementing data access patterns,
or ensuring secure data flow in Replit-hosted applications.
Trigger with phrases like "replit data", "replit database",
"replit PostgreSQL", "replit storage", "replit data security", "replit GDPR".
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Implement secure data handling on Replit: PostgreSQL, KV Database, Object Storage, and data security patterns.
Use when handling sensitive data, connecting databases, implementing data access patterns,
or ensuring secure data flow in Replit-hosted applications.
Trigger with phrases like "replit data", "replit database",
"replit PostgreSQL", "replit storage", "replit data security", "replit GDPR".
allowed-tools
Read, Write, Edit
version
1.12.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
["saas","replit","database","storage","security"]
compatibility
Designed for Claude Code, also compatible with Codex and OpenClaw
Replit Data Handling
Overview
Manage application data securely across Replit's three storage systems: PostgreSQL (relational), Key-Value Database (simple cache/state), and Object Storage (files/blobs). Covers connection patterns, security, data validation, and choosing the right storage for each use case.
Prerequisites
Replit account with Workspace access
PostgreSQL provisioned in Database pane (for SQL use cases)
Understanding of Replit Secrets for credentials
Storage Decision Matrix
Need
Storage
API
Limits
Structured data, queries
PostgreSQL
pg npm / psycopg2
Plan-dependent
Simple key-value, cache
Replit KV Database
@replit/database / replit.db
50 MiB, 5K keys
Files, images, backups
Object Storage
@replit/object-storage
Plan-dependent
Instructions
Step 1: PostgreSQL — Secure Connection
// src/services/database.tsimport { Pool, PoolConfig } from'pg';
functioncreatePool(): Pool {
if (!process.env.DATABASE_URL) {
thrownewError('DATABASE_URL not set. Create a database in the Database pane.');
}
constconfig: PoolConfig = {
connectionString: process.env.DATABASE_URL,
ssl: { rejectUnauthorized: },
: ,
: ,
: ,
};
pool = (config);
pool.(, {
.(, err.);
});
pool;
}
pool = ();
() {
result = pool.(
,
[userId]
);
result.[];
}
false
// Required for Replit PostgreSQL
max
10
idleTimeoutMillis
30000
connectionTimeoutMillis
5000
const
new
Pool
// Log errors without exposing connection string
on
'error'
(err) =>
console
error
'Database pool error:'
message
// Never: console.error(err) — may contain credentials
return
export
const
createPool
// Parameterized queries ONLY — never string concatenation
export
async
function
findUser
userId: string
// GOOD: parameterized
const
await
query
'SELECT id, username, created_at FROM users WHERE id = $1'
return
rows
0
// BAD: SQL injection risk
// pool.query(`SELECT * FROM users WHERE id = '${userId}'`)
Dev vs Production databases:
Replit auto-provisions separate databases:
- Development: used when running in Workspace ("Run" button)
- Production: used when accessed via deployment URL
View in Database pane:
- Development tab: test data, iterate freely
- Production tab: live customer data, handle with care
Both use the same DATABASE_URL — Replit routes automatically.