Deployed on Replit? Check what the internet can see.
Replit makes it easy to run a real server, and just as easy to leave a secret in the wrong place. We look at your deployed app from the outside and give you a prompt for Replit Agent for each problem. The free scan shows your score and how many problems you have; the Full Scan adds the evidence, a fix prompt for each one, and the deeper checks (database, exposed files, HTTPS/TLS, email spoofing, admin panels) after you verify you own the app.
The 8 most common Replit problems
Keys hard-coded instead of in Secrets
A secret key typed straight into your code can end up in files that visitors download. Replit’s Secrets keep keys on the server where they belong. The free scan checks this.
Exposed .env files
A .env file that can be requested from the live site usually holds database passwords and API keys. Part of the Full Scan.
Open Firebase data
A Firebase Realtime Database that anyone can read is critical. Firestore collections or Storage buckets that anyone can list are high. Part of the Full Scan.
Open Supabase tables
If your app uses Supabase, we check what the public key can read without signing in. We rate this high, and critical when the table holds personal or payment data. We only count rows. Part of the Full Scan.
API routes that answer without login
A route found in your site code returns user-like data (emails, roles, tokens) to a visitor who is not signed in. Part of the Full Scan.
A public .git folder
Your source code and its full history, including secrets you deleted long ago, can be downloaded. Part of the Full Scan.
Outdated JavaScript libraries
An old copy of a library such as jQuery, Bootstrap, AngularJS, Lodash, Moment.js or Handlebars with a publicly known security flaw, found in your page or its JavaScript files. The free scan checks this.
Weak HTTPS or email protection
HTTP that does not redirect to HTTPS, a certificate that is about to expire (rated high if it is not trusted or already expired), a missing SPF or DMARC email record (so anyone can send email that looks like it came from your domain), or an admin login page open to the public. Public source maps are reported too, as low. Part of the Full Scan.
How to fix them in Replit
- 01Run a free scan to see your score, then get the Full Scan for the location and a fix prompt for each red item.
- 02Pick Replit in the fix-prompt switcher and copy the prompt for each red item.
- 03Paste it into Replit Agent. Move private keys into Secrets (the lock icon) and read them only on the server.
- 04If a key leaked, create a new one at the provider. Deleting it from the code is not enough.
- 05Redeploy, then re-scan until the light is green.
Doesn’t Replit already check this?
Replit offers its own tools for managing secrets and reviewing your project, and you should use them. They work from the inside. Greenlight Scan checks the deployed app from the outside and confirms that the fix worked after you redeploy.
Full comparison →Questions
Do you need access to my Repl?
No. We only need the public address of your deployed app.
Do you change anything in my app?
No. Every check is read-only and we never download your data.
Can I scan an app that is not deployed yet?
No. We look at the live app, so it has to be reachable on the web first.
What does the free scan check, and what needs the Full Scan?
The free scan is passive. It reads what any browser downloads and checks it for leaked keys, security headers, cookie flags, mixed content and outdated JavaScript libraries. It shows your score, how many problems of each severity were found, and the title and why-it-matters of your top problem; the evidence, location and fix are hidden. The Full Scan unlocks every finding and fix prompt, and, after you verify you own the app, adds database and storage access, exposed files such as .env or .git, API routes that answer without login, Firebase rules, HTTPS and TLS certificate checks, SPF and DMARC email protection, open admin panels and public source maps.