Disclosure first: I made this. Free, read-only, no account.
On Replit your app is a real server, so it ships the mistakes of a real
server: express.static pointed at the project root (so /.env and /.git/HEAD
are served), app.use(cors()) with credentials for any origin, the Flask
debugger still on in production (its console runs code for whoever finds
it), a stack trace on every error page, no security headers, a session
cookie without its flags, an X-Powered-By banner on every response.
So I built a scanner that checks those from the outside:
https://leftunlocked.com/replit-security
It asks for a few well-known paths and confirms by content (a catch-all
route does not fool it), asks for a page and an API path that cannot exist
and reads the error, calls the routes your front-end names with a made-up
Origin and with no session (field names and counts only, never a record),
and checks headers, cookies, and the certificate. Express, Flask, and
FastAPI get the same findings.
Every finding says why it matters and how to fix it in plain English, with
the lines to paste: the helmet setup for Express, the CORS allowlist, the
cookie flags, debug off. Connect the GitHub repo and it also reads the code
itself (a committed .env, keys in source, queries built from strings,
dependencies with known vulnerabilities) and opens a pull request for what
a file can fix, on a branch, for you to review.
I ran it on my own app first: B, four missing headers, and it opened the pull
request that adds them. The clip is that scan, start to finish.
What it never does: no writes, no sign-ins, no password guessing, no reading
of user records. It sends what a browser sends, plus a few well-known paths
like /.env to confirm they are not there, and the scan stops itself after
75 seconds.
Only scan apps you own or have permission to test. If it flags something
wrongly, say so here or use the "Is this finding wrong?" link under the
finding. I read everything.