# Replit app security checklist for a live app

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

What to check on an app you built with Replit before you share it, from secrets to permission checks, and what an outside check adds.

A Replit app is ready to share when its secrets stay on the server, every action checks who is asking, and the published site sends nothing extra. Atlas, our example app at atlas.example, is the example throughout.

## Where do secrets go on Replit?

Replit says to use Replit Secrets to store sensitive information like API keys. Your server code reads them as environment variables. Replit's own checklist says not to pass secrets to the client side. In practice that means a key used by the server never appears in a script the browser downloads, so move any call that needs a secret into a server route.

## Does every action check who is asking?

The same checklist says to always verify permissions before performing actions. A page that hides a button is not a permission check. The server route behind the button has to refuse a request from someone who should not make it, even when that request is typed by hand.

| Question to ask of each route | Good answer |
| --- | --- |
| Does it need someone signed in? | It returns an error without a valid session |
| Does it need the right person? | It checks the record belongs to the caller |
| Does it return only what the page needs? | It leaves out other people's data and internal fields |

## How to check the published app

1. Publish the app and copy the public address.
2. Run a [quick check](/check) on your published address to see what a stranger sees, then read [how we check](/docs/security/how-we-check) for what it covers.
3. Paste each fix prompt into Replit Agent, review the change and publish again.

An outside check does not read your Replit project or its Secrets. It does not prove every route checks permissions either. It shows what the public address sends to a stranger, which is where a leak would show first.

## Questions people ask

### Are Replit Secrets visible in the browser?

Not unless your code sends them there. Secrets are read by your server code, so keep the calls that use them on the server.

### Is hiding a button enough to protect an action?

No. The server route has to check who is asking, because anyone can send the request without your page.

## Sources

- [Security checklist](https://docs.replit.com/learn/security-checklist), Replit docs, read on 2026-10-06