Replit secrets and who can read them

Replit's secrets doc says hard-coded credentials leak through a public project, git, or a screen share, and that some collaborators can print secret values even when the UI hides them.

Share link · Share on X

Last updated Oct 14, 2026

highSecrets

Shows up in: Supabase

Markdown version

What it is

Replit's secrets documentation says the Secrets tool encrypts API keys, tokens, and database connection strings and exposes them as environment variables, so you do not hard-code them. The same page lists three ways a hard-coded secret gets out: a public Replit project or copy-paste, a public git repository, and a livestream or screen share.

The visibility table on that page says a non-owner remix does not show secret values. It also says organization members without the Owner role cannot view secret values in the UI, but can access them by printing the environment variables. That is a real access path. It is not a reason to print printenv in a public repl.

Replit does not, on that page, describe Supabase row level security. If the repl uses Supabase, Supabase's securing-data guide is the source for RLS and for keeping the secret key off the client. This page does not invent a rate at which Replit apps skip auth.

How to check in 5 minutes

Search the repl for strings that look like API keys, and for DATABASE_URL written into a file. Replit says adding its database creates a DATABASE_URL secret. The value belongs in Secrets, not in source.
Open the Secrets tool and confirm credentials are secrets, not configurations. The doc says configurations are for non-sensitive values such as log levels and public URLs, and that API keys must not be stored as configurations.
If collaborators can open the Shell, assume they can read environment variables. The doc says non-owners in an organization can print them even when the eye icon is hidden from them.

How to fix

Replit

Move credentials into Secrets. Delete them from source and from configuration entries. Rotate anything that was hard-coded or printed. Use production app secrets, under Publishing, when the published app needs different credentials than the editor. Do not rely on a hidden eye icon as the only control for organization members.

Supabase

If the repl uses Supabase, enable RLS and keep the secret key in an environment variable the browser bundle does not contain. Supabase says the publishable key is the client key only when RLS and grants are on.

Copy-paste prompt

Paste this into Cursor, Claude Code, or whichever agent is editing the repo. Read the diff before you merge it.

You are removing hard-coded secrets from a Replit project. Do not add features.

1. Find credentials in source and in Configurations. Move them to Secrets.
2. Do not print environment variables in code that ships.
3. If Supabase is connected, show whether RLS is enabled. Do not claim a number of vulnerable Repls.

Questions

Does remixing copy my secret values to a stranger?

Replit's table says a non-owner remixing the project, and anyone remixing from the cover page, cannot see secret values. Owners and collaborators remixing their own project can. Organization members who are not owners cannot see the values in the UI and can still print them.

Are secrets available on a static deployment?

The doc says secrets are available for all deployment types except Static Deployments.