AppNightGuardIs my Replit app secure? 8-point checklist + free scan
Eight things to check on a live Replit app, each with a fix prompt you can paste straight into Replit. Or run the free scan and get all eight checked in seconds.
No secret API keys in your HTML or JS bundles
We scan your page and up to 15 same-origin JS bundles for live Stripe, OpenAI, Anthropic, AWS, GitHub, Google, Slack keys and private key blocks.
Fix prompt (copy into Replit):A secret API key is exposed in my frontend code. Move every call that uses it into a server route that reads the key from Replit Secrets, remove it from client code and any VITE_ / NEXT_PUBLIC_ variables, and tell me which keys I must rotate.
No Supabase service_role key in the browser
A service_role key bypasses Row Level Security. We decode Supabase JWTs in your bundles and flag any with role service_role.
Fix prompt (copy into Replit):My Replit app ships a Supabase service_role key to the browser. Replace it with the anon key in client code, move privileged queries into a server route that reads the key from Replit Secrets, make sure RLS is enabled on every table, and remind me to rotate the service_role key.
/.env is not publicly readable
We request /.env on your domain and flag it if it returns environment variables.
Fix prompt (copy into Replit):My deployed Replit site serves /.env publicly. Make sure .env files are never copied into the build output or public folder, add them to .gitignore, and tell me to rotate every value that was in it.
/.git is not publicly readable
We request /.git/HEAD and /.git/config, which expose your source history if served.
Fix prompt (copy into Replit):My deployed Replit site serves the /.git folder. Exclude .git from the published output and confirm /.git/HEAD returns 404 after redeploying.
No production source maps
We probe the .map files for your JS bundles. Public source maps hand out your original source code.
Fix prompt (copy into Replit):My Replit production build publishes JavaScript source maps. Disable them for production (vite.config: build.sourcemap = false) and redeploy.
HTTPS with a valid, non-expiring certificate
We flag plain-HTTP sites and certificates that are expired or expire within 14 days.
Fix prompt (copy into Replit):Make sure my Replit app is only served over HTTPS: redirect HTTP to HTTPS and check the custom domain settings so the SSL certificate auto-renews.
Security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy
We read your response headers and flag each missing one.
Fix prompt (copy into Replit):Add these HTTP security headers to my published Replit app: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy. Keep the CSP compatible with my Supabase and analytics domains.
Homepage loads: no error page, blank build or slow response
We check the HTTP status, response time (warn over 5 s), near-empty pages and visible error messages.
Fix prompt (copy into Replit):My Replit app's homepage is broken (error page, blank page or very slow). Look at the latest change you made, check the console and build errors, and fix or roll back that change.
Free scan of your Replit app
Passive, public-only, no sign-up. Try it on https://your-app.replit.app.
FAQ
Is my Replit app secure by default?
Not necessarily. AI-built apps often ship secret keys in client bundles, miss security headers or publish source maps. Run the 8 checks above or a free scan to find out.
What does the free scan check?
Leaked secret keys (including Supabase service_role) in your HTML and JS, public /.env, /.git and source maps, HTTPS and certificate expiry, security headers, and whether the homepage loads.
Is the scan safe to run on my live app?
Yes. It is passive and public-only: it fetches the same pages and files any visitor could. Only scan sites you own or are authorized to scan.
Do I need an account?
No. The free scan needs no sign-up. Each finding comes with a copy-paste fix prompt.