What Replit doesn't set up for you
Replit Agent builds full-stack apps and publishes them with hosting and SSL handled, and Replit runs a security scan before every publish. Those scans read the project. A visitor's browser sees something else: the cookie banner, the response headers and the scripts that load on the first page.
What Replit gives you
- What Agent builds
- Unless you ask for something else, Agent builds a full-stack web app with a frontend and a backend, adding API routes, a database and server-side logic as the app needs them. Source: docs.replit.com (opens in a new tab)
- Database
- All Replit Apps come with a SQL database by default; Agent can set up PostgreSQL with an ORM when asked. Source: docs.replit.com (opens in a new tab)
- Hosting
- Publishing gives you a .replit.app address and you can connect a custom domain. Autoscale is the recommended deployment type, alongside Static, Reserved VM and Scheduled. Source: docs.replit.com (opens in a new tab)
What Replit already checks
- Replit runs a security scan before every publish, and a setting can block publishing when critical vulnerabilities are found. Source: docs.replit.com (opens in a new tab)
- Agent security scans (paid plans) build a threat model, map routes and data flows, run static analysis with Semgrep and HoundDog.ai, and look for privacy issues such as personal data flowing to logs or third-party APIs. Source: docs.replit.com (opens in a new tab)
- Package Firewall blocks known malicious packages at install time and is on by default. Dependency scans and CVE Auto-Protect cover newly disclosed vulnerabilities. Source: docs.replit.com (opens in a new tab)
What's still on you
Analytics and pixels that load before consent
Replit's scans work on code, packages and the publish process; for testing the running app from outside, its docs point to a separate black-box pen test. None of that clicks your cookie banner from an EU address. If you've added analytics or a pixel, check it waits for consent.
Patch checks:Critical Trackers load before consentHigh No cookie banner
A privacy policy that matches the data flows
Agent security scans can spot personal data heading to third-party APIs, which is a useful start. Your privacy policy still has to name those services, and keeping it current as Agent adds features is on you.
Patch checks:Critical No privacy policyMedium Privacy policy doesn't mention services the site uses
Security headers on the live app
Replit's publishing docs cover hosting and SSL but don't describe default response headers or a setting for them. Your app has its own server, so you can add Content-Security-Policy, framing rules and the rest in code. Someone has to, though.
Patch checks:Medium No Content-Security-Policy header
Keys and files anyone can fetch
Replit's build-time checks look for hardcoded secrets, which helps. Values the frontend needs still ship in its JavaScript, and a server that serves the project folder as static files can expose things like /.env or /.git. ShipPatrol only probes those paths after you verify you own the site.
Patch checks:Critical Secret API key in your JavaScriptCritical Configuration files can be downloaded
Pages search engines and link previews can read
Replit's docs don't say how Agent's frontends render. If yours renders in the browser, crawlers and link previews may see an almost empty page. Titles, descriptions, Open Graph tags, a sitemap and robots.txt need setting either way.
Patch checks:High Pages are blank without JavaScriptMedium Pages with missing or duplicate titlesMedium No sitemap.xml
Database rules if you brought Supabase or Firebase
Replit's own database is reached from your server. If you swapped in Supabase or Firebase and call it from the browser, its access rules are what protect the data, and test-mode rules let anyone read and write.
Patch checks:Critical Supabase tables readable with the public keyCritical Firebase data readable without signing in
Renewal wording if you charge a subscription
If the app sells a subscription, the sign-up page needs to say what renews, when, for how much, and how to cancel. Agent can build the checkout; the terms are yours.
Patch checks:High Subscription sold without clear renewal and cancellation terms
Alt text, contrast and form labels
Accessibility isn't part of Replit's documented scans. Images need alt text, text needs enough contrast, and form fields need labels a screen reader can announce.
Patch checks:Medium Images without alt textMedium Text contrast too lowMedium Form fields without labels
What ShipPatrol adds
- Tests the running site from the outside, from the UK, EU and US, with the cookie banner accepted and rejected.
- Compares your privacy policy with the services the site actually loads.
- Re-scans daily or from a deploy hook and emails you when something new appears.
- Works the same whatever built the site, so one checklist covers every project.
ShipPatrol isn't affiliated with Replit. Product names belong to their owners. Facts about Replit were checked against its own documentation on 21 October 2026 and may have changed since. Not legal advice.
Scan your Replit site.
Paste the published address. Patch visits from the UK, the EU and the US and tells you what he finds. Free, no signup.
Sources
- Replit docs: Web apps (opens in a new tab)
- Replit docs: SQL database (opens in a new tab)
- Replit docs: Publishing overview (opens in a new tab)
- Replit docs: Security overview (opens in a new tab)
- Replit docs: Agent security scans (opens in a new tab)
- Replit changelog: Security Agent (24 April 2026) (opens in a new tab)
- Supabase docs: API keys and row-level security (opens in a new tab)
- Firebase docs: Avoid insecure rules (opens in a new tab)
- ICO: Cookies and similar technologies (opens in a new tab)