Replit is one of the most aggressively scraped places for exposed keys, because public Repls are open by default and bots harvest them constantly. If a key ended up in your Repl's code, in a committed .env, or in shell history, rotate it now, then move it into Replit Secrets so it is never in the code again.
Why it's a problem
A public Repl is readable by anyone, and automated scrapers target Replit specifically because so many projects ship keys inline. OpenAI and cloud keys are the most exploited, and attackers run up large bills before you notice. Replit's Agent can also generate client-side JavaScript that embeds a key value directly, so a secret can be exposed in the browser even if you thought it was server-side.
How to fix it, in order
- 1Rotate the key immediately. Revoke and regenerate it at the provider. On Replit this is urgent because public Repls are scraped fast; assume the exposed key is already in someone else's hands.
- 2Check the provider's usage and billing. Look for API calls or charges you did not make. Exploited OpenAI and cloud keys often show a sharp spike.
- 3Move secrets into Replit Secrets. Use the Secrets pane (the lock icon) instead of a .env file or inline values. Secrets are injected as environment variables and are not exposed to people who fork or run your Repl.
- 4Make sure the key is only used server-side. If the Agent generated a browser fetch that uses the key, move that call to server code so the key never reaches the client bundle.
Why Replit does this
The Replit Agent optimizes for an app that runs in the preview, and calling a third-party API directly from generated frontend code with the key inline is the shortest path to that. If it hardcodes the value rather than referencing an environment variable, the key ships to the browser and into your public Repl.
Stop it happening again
Store every secret in Replit Secrets, never in code or a committed .env. Keep third-party API calls on the server so keys are not embedded in client JavaScript. Before making a Repl public, scan it for any inline key that slipped through.
The quick fix
- Rotate the key at once; public Repls are scraped within minutes.
- Check provider usage and billing for unauthorized calls.
- Move secrets into the Replit Secrets pane, not a .env or inline.
- Keep API calls server-side so the key never ships to the browser.
Common questions
How do I store a secret in Replit so it is not visible to forks?
Use the Secrets pane (lock icon in the left sidebar). Secrets are environment variables injected at runtime and are not visible to anyone who forks or views your Repl.
My Repl is public. Does that mean my secrets are exposed?
Only if they are in the code or a committed file. Secrets stored in the Secrets pane are kept separately and are not visible publicly, even in a public Repl.
Replit Agent wrote client-side JavaScript that calls an API with my key. Is that always a problem?
Yes. Any key in JavaScript that runs in the browser can be read by the user and by anyone who views the page source. The API call must move server-side so the key is never in the client bundle.