Replit

Check a Replit app from its public URL

A Replit deployment is a normal website to everyone else. Paste the URL you own. We request that page and a fixed set of paths on the same host.

We do not use the Replit API, and we do not open the workspace that built the app.

What this scan actually checks

• The HTML of the URL you paste, including inline scripts.
• Up to 10 JavaScript files linked from that page, and only if they are on the same host.
• Response headers: Content-Security-Policy, Strict-Transport-Security on HTTPS, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, and a CORS wildcard.
• Set-Cookie flags when a cookie is present: Secure, HttpOnly, and SameSite.
• A noindex robots meta tag or X-Robots-Tag, the page title, and the meta description.
• Whether /robots.txt and /sitemap.xml exist and are not the HTML app shell.
• Up to 25 same-origin links on the homepage, a few at a time.
• One request each for /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
• Public secret patterns in the files we fetched: Stripe secrets, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys.

What it does not check

• It does not log in, try passwords, brute-force paths, or query a database.
• It does not read third-party scripts, your Git host, or the builder's project files. If a secret never shipped in the public response, this scan will not see it.
• Supabase Row Level Security and Firebase security rules are not checked. Those stay listed as coming soon until you can prove you own the domain.

What to do with the result

• Secrets that Replit keeps in the deployment's server environment are not in the browser bundle. Secrets that were pasted into client code are.
• Headers are set by whatever serves the page. If Content-Security-Policy or a framing header is missing, the report says so, even when the app code looks fine.

Questions

All guides →