Built with Replit

Is your Replit app safe?

Replit built it and runs it. Enter the address and we ask your app what a stranger would ask it. No account needed.

What the free check asks your app

A Replit app comes with a PostgreSQL database, and Replit Auth signs people in when you ask Agent for it. Published apps get an address that ends in replit.app.

Can anyone download files like .env or .git?
What could happen Whoever asks gets your credentials, or your code with every key that was ever committed to it.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Are backups, database exports or folder listings reachable?
What could happen Your data, code or configuration is one download away.
On 16 cases it had never seen, it found 7 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Is your app running in development mode?
What could happen A development server hands out your source code, and Vite's has had flaws that let anyone read files on the machine, keys included.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free checkHigh at worstHow we check
Does your API answer requests from any website?
What could happen A page your signed-in user visits reads or changes their data without them knowing.
On 16 cases it had never seen, it found 6 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKHigh at worstHow we check

On a Replit address

Your app lives on Replit’s domain until you give it one of your own. That changes three things.

The first check runs every question above, on the tick you give it, and shows each finding’s title and how serious it is at once.
For the checks that need your OK, where a finding sits and how to fix it open once you confirm your domain. That takes one DNS record, so it needs a domain of your own instead of your-app.replit.app.
On your-app.replit.app we skip the checks of your email records and of subdomains others could claim, because those belong to Replit.

Put your app on your own domain in Replit

What we read once your repository is connected

Some mistakes only show in the code. On a paid plan we read your repository too.

Can signed-in users reach other customers’ records?
What could happen A stranger or another customer reads, changes or deletes data that is not theirs.
Paid plan, your codeCritical at worstHow we check
Are secret keys written into your repository?
What could happen Anyone who can read the repository, now or later, can use the key.
On 20 cases it had never seen, it found 10 of 10 broken setups and called 2 of 10 safe ones broken.
Paid plan, your repositoryCritical at worstHow we check
Can strangers use your AI features on your bill?
What could happen Anyone uses your app as a free AI service and runs up your provider bill.
Paid plan, your codeHigh at worstHow we check

Replit’s check and ours

Replit’s own security center scans your packages and the files Agent changes, and scans again before you publish. We ask the app you published, from the outside, the way a stranger would.

Replit

While you build

Reads your project in the editor, before it goes out.

Vallit

Once it is live

Asks the published app from the outside, then again every day.

Both are worth having. Theirs reads your project while you build. Ours checks the live app again every day, and our team can fix what it finds.

What Replit checks

How often these checks are right

Read the study

We wrote 84 cases these checks had never seen, half broken and half safe, and scored each set once.

of the 7 checks on this page were in the benchmark: 5
broken setups they found the first time: 39 of 42
safe setups they called broken: 4 of 42