replit-policy-guardrails

name	replit-policy-guardrails
description	Enforce security and resource policies for Replit-hosted apps: secrets exposure prevention, resource limits, deployment visibility, and database access controls. Use when hardening a Replit app for production, auditing security posture, or setting up guardrails for team development. Trigger with phrases like "replit policy", "replit guardrails", "replit security audit", "replit hardening", "replit best practices check".
allowed-tools	Read, Write, Edit, Bash(npx:*)
version	1.12.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","replit","security","policy"]
compatibility	Designed for Claude Code

Replit Policy Guardrails

Overview

Policy enforcement for Replit-hosted applications. Replit's public-by-default Repls, shared hosting, and resource limits require specific guardrails around secrets exposure, resource consumption, deployment security, and endpoint protection.

Prerequisites

• Replit account with Deployment access
• Understanding of Replit's security model
• Awareness of Replit's Terms of Service

Instructions

Step 1: Secrets Exposure Prevention

Replit Repls are public by default on free plans. Source code is visible to anyone.

# CRITICAL POLICY: Never hardcode secrets in source files

# BAD — visible to anyone viewing your Repl
API_KEY = "sk-live-abc123"
DB_PASSWORD = "p@ssw0rd"

# GOOD — use Replit Secrets (AES-256 encrypted)
import os

API_KEY = os.environ.get("API_KEY")
if not API_KEY:
    raise RuntimeError("API_KEY not set. Add it in the Secrets tab (lock icon).")

# Startup validation — fail fast if secrets missing
REQUIRED_SECRETS = ["API_KEY", "DATABASE_URL", "JWT_SECRET"]
missing = [s for s in REQUIRED_SECRETS if not os.environ.get(s)]
if missing:
    raise RuntimeError(f"Missing required secrets: {missing}")

Automated secret detection:

// Pre-deploy check script: scripts/check-secrets.ts
import { readFileSync, readdirSync, statSync } from 'fs';
import { join } from 'path';

const  = [
  ,     
  ,
  ,
  ,
  ,  
];

 (): [] {
   content = (filepath, );
   : [] = [];

  .( {
     (pattern.(content)) {
      issues.();
    }
  });

   issues;
}

 (): [] {
   : [] = [];
   entries = (dir);

   ( entry  entries) {
     ([, , , ].(entry)) ;
     path = (dir, entry);
     ((path).()) {
      issues.(...(path));
    }   (.(entry)) {
      issues.(...(path));
    }
  }

   issues;
}

 issues = ();
 (issues. > ) {
  .();
  issues.( .());
  process.();
}
.();