Replit is safe to use, but a Replit app can leak secrets easily because public Repls are open by default and are among the most aggressively scraped places for exposed keys. The Agent can also generate client-side code that embeds a key, exposing it in the browser. The fix is to keep every secret in the Secrets pane and keep API calls on the server.
The risks that actually matter
Exposed keys in public Repls
Public Repls are readable by anyone, and bots harvest them constantly. OpenAI and cloud keys are the most exploited, often running up large bills before you notice.
Agent-generated client-side keys
The Agent may write a browser fetch that includes the key value, so a secret ends up in client JavaScript even if you meant it to be server-side.
Secrets in .env files and shell history
Keys left in a committed .env or typed into the shell can be exposed through the Repl or its history.
How to secure a Replit app
- Store every secret in the Replit Secrets pane, never in code or a committed .env.
- Keep third-party API calls server-side so keys are not in the client bundle.
- Rotate any key that was ever in a public Repl; assume it is compromised.
- Scan the Repl for inline secrets before making it public.