Replit App Launch Checklist

1. Secrets, not hard-coded keys

Replit has a built-in Secrets tool that exposes values as environment variables. API keys pasted straight into main.py or index.js end up in your repo, your forks and sometimes your frontend.

How to check: Search your project for sk-, sk_live_, AKIA, service_role. Then check your live site's JavaScript too — or let ChillScan look.

Important: If a key was ever public (public Repl, pushed to GitHub), rotate it with the provider, not just move it.

Find every hard-coded API key, password or token in this project. Move each one into Replit Secrets, read it with process.env / os.environ on the server only, and make sure none are sent to the browser. List the secret names I need to create.

2. Ship a real Deployment

The Run button's dev URL is for building, not for users. Use Replit Deployments (Autoscale, Reserved VM or Static) so your app has a stable URL and doesn't depend on your workspace being open. Remember: Deployments need their own copy of your Secrets.

3. Custom domain + HTTPS

Connect your own domain in the Deployment settings and add the DNS records it asks for. Replit provisions HTTPS for you; then confirm:

• http:// redirects to https:// in one hop.
• No images, scripts or API calls go over plain HTTP (mixed content).
• Old .replit.app links redirect or are canonicalized to your domain.

4. Cold starts vs response time

Autoscale deployments can scale to zero when idle, so the first visitor after a quiet spell may wait a few seconds. That's a cold start, not a slow app — but users (and Google) still feel it.

How to check: Hit your site after it's been idle, then again right after. A big gap means cold starts; slow every time means the app itself needs work. ChillScan reports server response time so you can compare.

Options: If first-load matters, consider a Reserved VM, a static deployment for the landing page, or caching expensive work.

5. Security headers

Most Replit apps are Express, Flask or FastAPI, so headers are set in code. At minimum you want: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a Content-Security-Policy (start in report-only mode).

See also what ChillScan checks for headers.

Add security headers to every response: Strict-Transport-Security, X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, and a Content-Security-Policy in report-only mode. Use helmet if this is Express, or middleware if this is Flask/FastAPI.

6. Basic SEO

• Real <title> and meta description on each public page.
• Open Graph tags + an OG image for nice link previews.
• /robots.txt and /sitemap.xml served from your custom domain.
• Landing page text visible in View Source, not just after JavaScript runs.

Add a unique title, meta description, canonical URL, and Open Graph/Twitter tags to every public page. Serve /robots.txt and /sitemap.xml from the app, and make sure the landing page HTML contains the main content without needing JavaScript.

7. Lock down data and endpoints

Check that every API route checks who's logged in, that user A can't load user B's data by changing an ID, and that anything costing money (AI calls, emails) has rate limits. Turn off debug mode in production so errors don't leak stack traces.

The Replit pre-launch checklist

Copy this into a note before you share the link.

[ ] No hard-coded keys; everything in Replit Secrets
[ ] Leaked keys rotated with the provider
[ ] Deployment (not the dev URL) serving users
[ ] Deployment has its own Secrets set
[ ] Custom domain connected, HTTP → HTTPS
[ ] No mixed content
[ ] Cold start understood (Autoscale vs Reserved VM)
[ ] Security headers set in app code
[ ] Title, description, OG tags, sitemap, robots
[ ] Auth on every API route, rate limits on paid calls
[ ] Debug mode off in production