Replit Known Pitfalls

Overview

Review a Replit App against current platform boundaries without changing deployment state. The audit distinguishes the editable Preview environment from the published app and treats model-generated code, production configuration, and public endpoints as separate trust boundaries.

Prerequisites

• Read-only access to the project and its .replit, dependency manifests, server entry point, and authentication middleware.
• The intended deployment type and access policy: Public, Password protected, Workspace only, or Invite only.
• The expected production data stores, required Secret names, and public hostname. Do not request Secret values.
• Approval before changing Publishing settings, production data, DNS, or access controls.

Instructions

1. Use Read to identify the run/build path, listening host and port, persistence layer, auth middleware, and health endpoint.
2. Use Grep or the count-only audit below to locate candidates. Treat matches as review leads, not proof of a vulnerability.
3. Compare Preview and published-app configuration explicitly. A successful Preview does not prove production Secrets, callbacks, data, or access settings are correct.
4. Classify each finding as confirmed, not applicable, or needs owner verification. Include file paths and remediation; never include credential values or raw customer data.
5. Stop before mutating a live app. Hand the owner a bounded change and a verification plan.