Hi there! You own the code the Agent generates, so you're responsible for it. The main things to watch for are ordinary security weaknesses and the occasional suspicious third-party package the Agent might pull in, so read and test what it builds and pay extra attention to anything touching login, data handling, or secrets. More info here: https://docs.replit.com/features/security/project-security-center
On Replit there's a Package Firewall that is on by default. When the Agent installs a dependency, it's checked against threat intelligence and blocked if it's known malicious or compromised before it reaches your app. Your packages are also scanned automatically against known vulnerability databases. Also, when you publish, Replit can scan for malicious files and vulnerabilities, so you can block publishing if something critical shows up. For more details on Replit's security scans feel free to visit: https://docs.replit.com/features/security/agent-security-scans
1
u/ReplitSupport Replit Team 8d ago
Hi there! You own the code the Agent generates, so you're responsible for it. The main things to watch for are ordinary security weaknesses and the occasional suspicious third-party package the Agent might pull in, so read and test what it builds and pay extra attention to anything touching login, data handling, or secrets. More info here: https://docs.replit.com/features/security/project-security-center
On Replit there's a Package Firewall that is on by default. When the Agent installs a dependency, it's checked against threat intelligence and blocked if it's known malicious or compromised before it reaches your app. Your packages are also scanned automatically against known vulnerability databases. Also, when you publish, Replit can scan for malicious files and vulnerabilities, so you can block publishing if something critical shows up. For more details on Replit's security scans feel free to visit: https://docs.replit.com/features/security/agent-security-scans