Can Replit apps be hacked?

Replit-Specific Attack Vectors

These are the paths attackers actually take into Replit applications — not a generic OWASP list, but what automated scanners and security researchers find when they look at Replit apps specifically, given the stack (Supabase (Postgres + RLS) as the database):

1. **Credentials in Public Repls**: API keys and passwords visible in public Repl source code.

2. **AI Agent Database Destruction**: Replit's AI agent can make unintended destructive database changes.

3. **Secrets Not Using Replit Secrets**: Developers using .env files instead of the proper Secrets feature.

4. **Shell History Exposure**: Commands with secrets visible in Repl shell history.

5. **Fork Inheriting Secrets**: Forked Repls may carry over secrets from original.

**Supabase-Specific Risk**: Replit apps typically ship with the public Supabase anon key embedded in frontend code. That is by design — but only works safely if Row Level Security is enabled on every table. Attackers routinely query Supabase endpoints directly using the anon key from your bundle. A single table without RLS is a full data leak.

Real-world example

Common to find database passwords and API keys in publicly browsable Repls.

How attackers find these issues

Attackers don't target Replit apps specifically — they run automated scanners across the entire internet looking for known patterns. Supabase URLs follow a predictable pattern (`*.supabase.co`), making Replit apps easy to fingerprint. Once identified, the scanner probes the specific vulnerability classes listed above.

What a security scan of a Replit app looks at

• **Secret Exposure** — Scans for API keys, database URLs, and credentials that may have leaked into client-side code or public files.
• **Database Security** — Tests database connections for proper authentication and checks if data is properly protected.
• **Deployment Config** — Checks your deployment configuration for security headers, HTTPS enforcement, and proper settings.
• **Authentication** — Analyzes your auth implementation for weak passwords, session security, and common vulnerabilities.