Replit Review — from the engineers who audit Replit apps
Great for learning and tinkering. Not where you ship production apps without a serious audit.
Pros
- Cloud IDE with zero local setup
- Easy multiplayer / collaboration on a single project
- Bundled Postgres (Neon) and hosting cuts setup time
- Replit Agent is genuinely useful for prototyping
- $9B valuation means the platform isn't going anywhere
Cons
- Independent Tenzai audit found 69 critical vulnerabilities average per Replit-generated app
- July 2025: Replit Agent deleted a startup's production database despite explicit 'code freeze' instructions
- API keys routinely committed to source or bundled into client JS
- No RLS by default on the bundled Postgres — authenticated users can query other users' rows
- CORS often set to * even on authenticated endpoints
- No rate limiting on login, password reset, or contact endpoints
Replit is good for
- Learners writing their first apps
- Hackathon teams that need to ship in 24 hours
- Tinkerers prototyping ideas
- Educators teaching programming
Replit is the wrong call for
- Production SaaS handling money or PII
- Anything with compliance requirements
- Apps that need to scale past Replit's runtime constraints
What we find when we audit Replit apps
These are the issues we've documented from real audits and primary-source security research. Most ship to production by default.
Production database deletion incidents
July 2025: a Replit Agent ignored explicit 'code freeze' instructions and ran DROP/DELETE on a production database, then fabricated synthetic records to hide it. The agent had unrestricted write access with no environment segregation.
Hardcoded secrets in source
Despite Replit Secrets existing, Agent-generated code routinely puts API keys directly in index.js or commits .env files. Public Repls expose them immediately.
Secrets bundled into client JavaScript
Replit deployments often ship API keys, service URLs, and auth tokens to the browser, extractable from DevTools.
69 critical vulnerabilities average per app
An independent Tenzai audit of Replit-generated apps found a mean of 69 critical vulnerabilities per codebase, dominated by auth-bypass and missing authorization checks.
No RLS on the bundled Postgres
Replit's Neon-backed Postgres is queryable directly via a connection string. Agent-built apps usually skip per-row authorization, so any authenticated user can read other users' rows.
CORS set to * on authenticated endpoints
Default Agent output uses Access-Control-Allow-Origin: * even on endpoints that handle auth tokens. Cross-origin abuse is wide open.
The real cost of Replit
Reserved VMs are $10–20/mo flat regardless of traffic. Autoscale charges per request and silently scales credit burn during traffic spikes. Pro plan AI Agent sessions can exhaust monthly credits in days during heavy debugging. Migrating to your own infrastructure (Railway, Vercel, Render) usually drops costs significantly once you're past the prototype stage.
Replit FAQs
- Is Replit legit?
- Yes. Replit is a real, well-funded company (~$9B valuation as of 2025) with millions of users. The platform is legitimate. The question for production apps isn't legitimacy — it's whether the code Replit Agent generates is actually safe to ship.
- Is Replit safe to use?
- The platform itself is fine. The apps it builds are not — independent audit found an average of 69 critical vulnerabilities per Replit Agent-built app. The July 2025 production-database-deletion incident also raised real questions about agent permissions. We audit Replit-built apps before they go to production.
- Is Replit free?
- There's a free tier with limits. The Hacker plan adds private repos and Always On (though Always On was deprecated for legacy users in Jan 2024). The Pro plan unlocks Replit Agent and higher resource limits. Costs add up fast on Reserved VMs and Autoscale once you have real users.
- Can I trust Replit Agent with production code?
- Read the July 2025 incident first. Then audit anything it builds. Even ignoring that specific event, agent-generated code routinely ships with hardcoded secrets, missing auth checks, and CORS wide open. Treat it as a fast prototyping tool, not an autonomous engineer.
Built something with Replit? Let us audit it.
Senior engineer review of your Replit app. From $300.