replit-security-basics

name	replit-security-basics
description	Apply Replit security best practices: Secrets management, REPL_IDENTITY tokens, Auth headers, and public Repl safety. Use when securing API keys, validating request identity, or auditing Replit security configuration. Trigger with phrases like "replit security", "replit secrets", "secure replit", "replit public safety", "replit identity token".
allowed-tools	Read, Write, Grep
version	1.12.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","replit","security","secrets","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Replit Security Basics

Overview

Security best practices for Replit: Secrets (AES-256 encrypted env vars), REPL_IDENTITY token verification, Auth header trust model, public Repl exposure risks, and Secret Scanner protection.

Prerequisites

• Replit account with Workspace access
• Understanding of environment variables
• Deployed app (for Auth security)

Instructions

Step 1: Secrets Management

Replit Secrets are AES-256 encrypted at rest with TLS in transit. Keys rotate regularly. Two scopes:

App-level secrets: Specific to one Repl (lock icon in sidebar)
Account-level secrets: Apply across all your Repls (Account Settings > Secrets)

// Validate all required secrets at startup — fail fast
const REQUIRED = ['DATABASE_URL', 'JWT_SECRET', 'API_KEY'];
const missing = REQUIRED.filter(k => !process.env[k]);
if (missing.length) {
  console.error(`Missing secrets: ${missing.join(', ')}`);
  console.error('Add them in the Secrets tab (lock icon in sidebar)');
  process.exit(1);
}

Secret Scanner: Replit detects when you paste API keys into code files and warns you to store them as Secrets instead. Never dismiss this warning.

Step 2: Public Repl Safety

Replit Repls are public by default on free plans. Your source code is visible to anyone.

# CRITICAL: Never hardcode secrets in source files
# BAD — visible to anyone who views your Repl
API_KEY =   


 os
API_KEY = os.environ.get()