What does a Replit app audit check?
Secrets handling
Keys in code, in the repl, or in a fork, and whether any of them can be rotated.
Auth configuration
Session handling, provider setup, and access checks on every server route.
Authorization
Server-side permission enforcement, including admin and internal endpoints.
Database setup
Schema, constraints, indexes, and whether the storage choice suits the access pattern.
Data durability
Backups, restore, and what survives a redeploy or a rollback.
Deployment configuration
Deployment type, environment separation, and configuration that differs from development.
Public exposure
What is reachable on the public URL, including files, endpoints, and debug routes.
Object storage
Bucket permissions, upload validation, and public-by-default objects.
Input validation
Server-side validation on every write path.
Dependencies
Installed packages, known CVEs, and version pinning for reproducible builds.
Performance
Cold starts, request-path work, and behaviour under concurrent load.
Scalability
The traffic the current setup carries, and what has to move when it does not.
Observability
Logging and error tracking that outlive a single container.
Portability
What is tied to the platform, and the work required to run this elsewhere.
Production readiness
Monitoring, alerting, rollback, and operational ownership after launch.
Other audits
Each audit answers a different question. Most engagements combine two or three.
Build with
confidence.
AI builds the product. Vibecop makes sure it won’t break in production, fail under scale, or expose your users to risk. One audit. Fewer expensive surprises.