Check your Replit app before real users arrive. Start free.
Replit Agent can build and host a whole app. Before people rely on it, check what it exposes: secrets in the code, API routes that answer without signing in, private files online, and screens a normal user shouldn't reach.
Free from the outside in minutes. Behind the login when you're ready, on your test copy.
What we check in Replit apps
The things Replit apps most often need fixing before launch. The free check covers the first two from the outside; the paid checks sign in and cover the rest.
Secrets in the code
Keys belong in Replit's Secrets, not in the code. Ones that slip into the browser's files can be copied by anyone. We check every script the app loads.
Private files and error details
Files like .env and .git, and error pages that show the server's code, tell an attacker how the app works. We check the usual places.
API routes that answer anyone
Apps built quickly often have routes that return data without checking who's asking. With the paid checks, we repeat each signed-in user's requests to see what answers without the right access.
Who can see what
With the ₹299 check, we sign in as a normal user and try admin screens and other users' records. The ₹999 check repeats every request as two or three users.
Speed and errors on every screen
Signed in, we open every screen on a computer and a phone, and note errors, failed requests and slow screens.
Three ways to check your app
Start free, from the outside, the way any visitor sees your app. Then let us in as a test user to check the app itself, or as two or three users for the audit-ready check.
Security from the outside
- Secret keys in your app's code, and databases anyone can read
- Private files left online (.env, .git), published source code
- Security headers, sign-in cookies and the certificate
- API docs, diagnostics and folders open to anyone
- Libraries with known vulnerabilities, error pages that leak details
- Load speed, and your public pages if you have any
The product itself
- Access control: can a normal user reach admin screens or other customers' data?
- What your server sends the browser: password data, codes, secret keys
- Personal data in addresses or sent to third parties; cookies, CORS, GraphQL
- Errors, failed requests and broken screens
- Numbers and calculations checked across every screen
- Usability and layout on a computer and a phone
Offered on your report once the free check sees an app. Money back if we can't sign in.
Audit-ready check
- Everything in the ₹299 check
- Two or three test users: every request repeated as each one, to see who can read what
- Safe security tests on your test copy, such as injection and cross-site scripting
- Sign-in, sessions and tokens
- Accessibility (WCAG 2.2) and India's data protection law (DPDP)
- OWASP, WSTG and ASVS references on every finding, and a free re-check after you fix things
Runs on a test copy of your app, with your written permission. Full refund if we can't complete your report.
Your app, your data, your call
Look, don't touch
The free and ₹299 checks only open screens. They never press save, send, pay or delete, and skip anything that signs out or removes data. The audit-ready check adds safe tests, on your test copy only.
Nothing kept
No screenshots or page content are stored, and we delete our copy of the test user's password when the check ends. Our AI reviews each screen during the check, then it's discarded.
You're in control
It's a test user you add, and you delete it when the check is done. We never ask for your password or your customers'.
Money back
If we can't sign in after three tries, or you cancel before it runs, you get a full refund.
Check your test copy, not your live app
A test copy (often called UAT or staging) is a second copy of your app with its own data, where changes are tried before customers see them.
We'll ask which copy to check before you pay. If you don't have one, we'll still check your live app and flag it in your report: without a test copy, every change and every test happens where your customers are.
FAQ
How is this different from testing it myself?
You test as yourself, usually as the admin. We check the live app the way your users and an attacker see it: from the outside for free, and signed in as your test users with the paid checks.
My app is on a .replit.app address. Is that fine?
Yes. Enter the address your users visit, on replit.app or your own domain.
Do you need my Replit login?
No. We only need your app's address. For the paid checks you add a test user to your app.
Can I give the fixes to Replit Agent?
Yes. Each finding says what to change in plain words, ready to paste into Replit Agent or give to your developer.
What's free and what's paid?
The check from the outside is free: your grade and top findings straight away, and the full list when you leave your email. The signed-in check is ₹299 and the audit-ready check is ₹999, both GST included. We email you the report when it's ready.
What if you can't sign in?
We tell you why so you can fix it and try again, up to three times. If we still can't get in, you get a full refund automatically.
Check your Replit app before real users arrive.
Free from the outside. ₹299 and ₹999 checks behind the login when you're ready.