Built it with Replit? Check what the agent left exposed.
Replit's agent can build and ship a whole app, and it's genuinely impressive. It also makes the quiet decisions — where secrets live, who can reach the database, what the app trusts — and those are the ones that come back to bite. A Defuse review goes through them before your users, or an attacker, find them.
Where Replit apps tend to go wrong
- Secrets hardcoded instead of stored. Keys and passwords written into the code, where they end up in the repl, in the logs, and in anyone's copy — rather than in Replit's Secrets.
- A public repl leaking its source. If the project is public, so is everything in it, including whatever was hardcoded above.
- The data store open to the world. Databases and endpoints the agent wired up with weak access control, reachable directly.
- Decorative auth. Login that checks you're someone, but never that you're allowed to see this particular thing.
- An agent with the keys to production. An AI that can change live data and infrastructure on its own is one bad instruction from a very bad day — a line that's been crossed in public more than once. Where the boundaries sit matters as much as what the code does.
None of this means Replit is the wrong choice. It means the review is worth doing — these are defaults and omissions, not deep flaws, and they're fixable.
You've already done the hard part.
You worked out what the product should do, and real users proved you right. That's the part that takes judgement, and it's yours. What's left is engineering — making the thing you designed safe, solid and able to grow — and that's a known quantity, not a mystery. The point of a review isn't to take Replit away; it's to let you keep building fast without the nasty surprise.
What a Defuse review gives you
- A findings report, ranked by real-world risk, in plain English with the technical detail underneath
- A Keep / Fix / Rebuild verdict, with the reasoning shown
- A remediation plan your AI tool can actually follow
- A 45-minute walkthrough call
It's a fixed £950, and you own the report — you can take it to any developer. Most Replit apps start and finish with Defuse; where a finding needs closing, that's the next step, not a precondition.
Built with something else? There are notes for Lovable · Bolt too.