Guides / Replit and v0 app security checklist
Replit and v0 app security checklist
Replit and v0 both make it easy to wire in API keys. Both also make it easy to put one where the browser can see it. Check these before you share the link.
Replit
1. Every credential lives in Secrets
Open your project, select Tools at the top, and under Setup select Secrets. Add each credential with New Secret; your code reads it as an environment variable. Search your code for any key that is hard-coded instead:
rg -n -e 'sk_live_' -e 'sb_secret_' -e 'service_role' -e 'sk-ant-' -e 'sk-proj-' -e 'AKIA[0-9A-Z]{16}'
2. Secrets vs Configurations
The Secrets tool has a separate Configurations section for non-sensitive values like log levels and feature flags. Replit's docs: never store API keys, passwords or tokens as configurations.
3. Check production secrets separately
Your published app can use different values. Open Publishing, select Adjust settings, and find Production app secrets. Make sure production uses production keys, and that test keys are not live.
4. Know who can see values
- Multiplayer collaborators can see secret names and values.
- People remixing your public project see names but not values.
- Org members without the Owner role cannot view values in the tool but can still read them by printing environment variables.
Only invite collaborators you would hand the keys to directly. Note that Secrets are not available for Static Deployments, so a static site must not need any secret at all.
5. A secret on the server is still public if you send it to the client
Secrets protect the value at rest. If your server route returns it, or your frontend build inlines it, it is exposed. Call third-party APIs from the server and return only the result.
v0 apps (Next.js on Vercel)
v0 generates Next.js apps that deploy to Vercel, so the rules below come from the Next.js and Vercel docs.
1. Audit every NEXT_PUBLIC_ variable
Next.js inlines any NEXT_PUBLIC_ variable into the browser bundle at build time. A Supabase URL, publishable key or analytics ID there is fine. An OpenAI, Stripe secret or Supabase secret/service_role key there is public. Rename it without the prefix and only read it in Route Handlers or server code.
2. Use Secret-type variables on Vercel
When adding a variable on Vercel you choose Config or Secret. Secret values are write-only after saving. Use Secret for credentials.
3. Scope variables by environment
Each variable can target Production, Preview, Development or custom environments. Give Preview deployments test keys, not live ones, since preview URLs get shared.
4. Redeploy after changing a key
Vercel applies environment variable changes only to new deployments. After rotating a key, redeploy, or the old one stays live.
5. If the app uses Supabase
The same RLS rules apply as everywhere else: see the Supabase RLS guide.
next step
Want a second pair of eyes?
Grab the free Lockdown Pack (security rules for Cursor and Claude Code plus a pre-launch checklist), or have us check the whole app for a fixed $99.
Sources
Every product step above was checked against these official pages. Last checked Oct 2026. Products change; if a menu moved, the docs below are the source of truth.