Replit

Security scan for Replit apps

Replit collapses editing, running and hosting into one place, which is convenient and also means a project that started as an experiment can end up publicly reachable without anyone deciding it should be.

Apps deployed from Replit are frequently still serving development configuration: verbose errors, permissive CORS, and secrets that were pasted inline while getting something working.

Scan your app

Or run it yourself

$pip install overshare
$overshare https://myapp.replit.app --fail-on high

What usually turns up on Replit apps

Development configuration in production

Debug output and permissive CORS settings that were fine on localhost are still in place on the public URL.

Hardcoded keys

Keys pasted directly into source while iterating, rather than read from Replit Secrets, end up in the served bundle.

Forgotten deployments

Old versions of a project can remain publicly reachable long after you have moved on from them.

What the scan actually does

It fetches your app the way any visitor's browser would, reads the JavaScript it ships, and checks the headers, certificate and DNS records that go with it. No login is attempted, nothing is modified, and no credential is used that was not already public.

See the full check list →