Security for apps built with Replit

Replit puts an app online in one click, but it just as easily exposes your workspace configuration. A public /.replit and /replit.nix reveal your structure, and REPLIT_DB_URL with its token hands over database access.

The fix: keys go in the Secrets panel, read them via process.env on the backend, route AI through a server route, and turn source maps off in your Vite config.