Skip to content
SSShipSafeStack

Ship guide

Ship a Replit app

Replit can publish an app with built-in auth, database, hosting, and monitoring. Those built-ins are convenient and they are still your configuration. This list is how to look at them before the published URL has real users.

Updated 16 Oct 2026 · Directory entry

A checklist for this builder, not a promise the app is production-safe. Confirm every setting in the project you actually generated.

  1. 01

    List the built-ins that are on

    In the project, note whether you are using Replit's database and auth or an outside service such as Supabase or Firebase. Two auth systems at once is a smell. Pick the one the data rules actually trust.

  2. 02

    Move secrets into the Secrets panel

    A key committed in a file, or prefixed so the client can read it, is public. Use Replit's secret storage for server-side keys and read the API key checklist.

  3. 03

    Prove a second user cannot read the first

    Create two accounts and try. Built-in databases still have an access model. If you connected Supabase, switch to the RLS checklist.

  4. 04

    Confirm publish does not mean production-safe

    The publish button creates a URL. Walk the pre-launch checklist on that URL. Add a rate limit on any route that spends money.

  5. 05

    Decide what monitoring is actually on

    Replit documents platform monitoring. If you also want stack traces in Sentry or product analytics, add them on purpose and mask anything that could be a secret.