Ship It Checklist

Checklists /Replit /Security

Critical

Put secrets in the Secrets pane, not in files

Replit Secrets stay out of the files you share. A key written into a script is one export or screenshot away from leaking. Deployment secrets are also separate from development secrets, so production can be empty even when the editor works.

How to check

  1. Open the Secrets tool in the workspace. Secret values used by the app should be listed there.
  2. Search the files for sk_live, service_role, and database URLs that include a password.
  3. Open the published app's secrets and confirm the same names exist there. Development secrets are not copied for you.
  4. If a key was in a file, rotate it after you remove it.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: secrets are read from environment variables, and the README lists the names I must add in Replit Secrets for both development and the published app.

Steps:
1. Search the code for hard-coded keys and passwords.
2. Replace them with process.env or the language equivalent.
3. Do not print current secret values.
4. Add a checklist of variable names, and note that published apps have a separate secret set.
5. Tell me if any key was sitting in a file, so I can rotate it.

This uses the same ticks as the checklist page, saved in this browser.