SniffPupReplit app security scanner for your live site
Built your app on Replit and published it? Paste the live URL below. SniffPup checks what your published app shows to anyone who visits it, passively and read-only.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Results cover your whole published site: secret keys, public files, source maps, Supabase or Firebase exposure and security headers. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
Start with Replit's own checks
Replit's Security Center scans your project from the inside, and Replit runs a security scan before you publish. Keep every key in the Secrets tool and use it only in server code. This scan adds a different view: your published app from the outside, the way a stranger's browser sees it.
What this checks
- Secret keys in your page and JavaScript, including anything that slipped into a
VITE_variable, AI and payment keys, and Supabaseservice_roleorsb_secret_keys. Any key found is masked in the report. - Public files at the root of your site:
/.envfiles (variable names only, never values),/.git/config,/.git/HEAD,/.npmrcand/.DS_Store, plus the source map your JavaScript points to. - Supabase or Firebase, if your app uses them: read-only requests with the public config your site already ships, to see whether an anonymous visitor can read your tables, collections or storage. No rows are downloaded.
- Security headers, cookie flags and HTTPS on the page you enter, plus whether your HTTPS certificate is valid and when it expires.
- Outdated JavaScript libraries with known vulnerabilities, when the exact version is readable.
What it can't tell you
- It can't see your code, your Secrets, your server routes or your database policies. Replit's Security Center and your own signed-out tests cover those.
- It doesn't log in, so pages behind sign-in aren't checked.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It is never proof of security.
A simple routine
- Run a Security Center scan and fix the critical and high findings.
- Move every key into Secrets and call paid APIs from a server route, not the browser.
- Publish, then scan the live URL here.
- Fix anything new, then scan again.
The free scan lists every issue by title and severity and gives the full fix for every critical issue free (with no critical, one other fix is free).
More: Is my Replit app secure? A pre-launch checklist and the vibe-coded app security checklist.
Questions
How do I scan my Replit app?
Publish your app with its access set to Public, then paste the published URL (a replit.app address or your own domain) into the box on this page. SniffPup checks what that site serves to any visitor.
Replit already scans my project. Why scan the live site too?
Replit's Security Center looks mostly inside your project: your dependencies and, on deeper scan levels, your code (Level 3 also adds a black-box test of your running app). A live-site scan adds the outside view: what your published app actually sends to a stranger's browser, such as a key that ended up in a VITE_ variable or a file left in the web root. Use both.
Does SniffPup need access to my Repl?
No. You only enter your live URL. SniffPup never logs in, never sees your code or your Secrets, and never uses a secret key it finds.
Can it scan an app that's private or behind Replit Auth?
SniffPup only sees what a signed-out visitor sees. If the URL answers with a blocked page or sends visitors to a sign-in page on another site, it tells you it couldn't scan instead of scoring that page. It never signs in.
Does a 100 score mean my Replit app is secure?
No. A 100 means no issues were found in our checks. It is never proof of security, and the scan can't see your code, your server logic or anything behind a login.