Your published Replit app is more exposed than you think - free 4-step check

The thing that makes Replit incredible is that Agent writes the code and publishes it behind a public URL in minutes which is the exact thing that bites people. "Edit" and "Publish" are basically one click, so the old "security review before launch" step just never happens. And everything about that public URL is visible. Including the mistakes.

What I keep finding on shipped Replit apps:

• Secrets hardcoded in the code instead of the Secrets tab - and if the repl is public, the keys are public too.
• API keys bundled into the frontend (OpenAI, Stripe sk_live, etc.). One curl and someone's running up your bill.
• Admin/data routes with no auth, because it worked while you were logged in.
• And the nightmare one: people have had the Agent wipe a production database during what they thought was a freeze.

Free 5-minute checklist before you share anything:

1. Move every secret into the Secrets tab. Nothing sensitive in the code itself.
2. If the repl is public, assume everything in it is public. Make it private or strip the secrets.
3. Open the deployed URL → F12 → search the bundle for sk_, key, secret.
4. Log out, then try to load your data endpoints. Still see data? So does everyone else.

I built a tool for this - upload your project zip, get back a single fix-prompt you paste straight into Replit, pay per scan. But the checklist above is free and catches the scary stuff, so start there regardless of whether you ever use it.

What's the worst exposure you've found in your own builds? Curious whether others are hitting the same patterns.