Replit

Replit Secrets versus keys in the published app

Replit Secrets stay on the server only if your code never sends them to the browser. Published files and a committed env file are public.

Updated 2026-10-27

Replit Secrets are private only inside the Repl's server process. The moment your code writes a secret into HTML, a client script, a log the browser can fetch, or a file the published site serves, that secret is public.

Replit's Secrets UI injects values as environment variables for the running program. A Python or Node server can read them while it handles a request. A React or static frontend that runs in the visitor's browser cannot read the Repl's environment unless you deliberately embed the value. Builders do that by accident when a prompt says "put the key in the config object" and the config object is imported by the client.

Files the published site will serve

A Repl can publish more than the page you intended. Check for:

• A .env or .env.local that was committed and is now fetched at /.env
• A .git directory, which starts with /.git/HEAD and can lead to source
• Source maps next to bundled JavaScript
• Hard-coded keys in client/, src/, or a static dist/ folder

The server entrypoint, often index.js or a Flask app, is the right place to read a secret and call Stripe, OpenAI, or Supabase with the service role. The client receives the result of that call, not the key. For Supabase in the browser, use the anon key and row level security, described in the Supabase RLS guide.

Deploying the Repl

"Run" and "publish" are different audiences. The editor is you. The published URL is anyone. Secrets configured for the deployment must be set on the deployment, not only in the editor sidebar, or the live app falls back to a key someone pasted into source.

Do not echo process.env or os.environ into a debug route and then forget the route. A JSON dump of the environment is a full leak even if the page looks blank in the editor.

If Vibe Scan reports a key pattern, rotate that key at the provider. Removing it from the next publish does not invalidate copies already downloaded, and it does not help if the old deployment is cached.

FAQ

Can the browser read Replit Secrets directly?

No. There is no client API that lists them. Code you wrote can still copy a secret into the page.

Should the Supabase service role go in Replit Secrets?

Yes, if a server route needs it. Do not also place it in client source. One copy in the bundle defeats the secret store.

What if /.git/HEAD returns a branch name?

The site is serving the Git directory. Turn that off at the host, rotate anything that lived in the repo, and assume the source was downloaded.