Platform
Replit breaks
Replit breaks: a secret pasted into the agent chat, and a legacy database URL that still contains usable credentials. Rotate only your own keys.
8 cards are tagged Replit. Symptoms in this set: Exposed data, Secrets, Payments, Over-open rules, Auth. Open a card for the root cause, the fix prompt, and the self-check. The check is only for an app you own.
Exposed data
Supabase tables ship with row level security off
The app looks correct while you are signed in. A request that carries only the publishable key, and no user session, can still read or write a table.
Exposed data
A policy uses USING (true) on private rows
Row level security is on, and the app still returns every row to any signed-in user, or to nobody at all.
Secrets
The service role key is in the browser bundle
Data API calls from the site ignore every row policy. Searching the shipped JavaScript turns up a secret or service role key.
Payments
The Stripe webhook accepts an unsigned body
A payment shows as paid, or a paid feature unlocks, when a request hits the webhook URL without a valid Stripe signature.
Over-open rules
Firebase rules allow every read and write
The app was created in Firebase Test mode, or the rules say allow read, write: if true. Anyone who knows the project can read and overwrite the data.
Secrets
A secret was pasted into the Replit Agent chat
The agent asked for a key, you pasted it into the prompt, and now the value is in the chat history instead of Secrets.
Secrets
A legacy Replit database URL was shared
Someone pasted DATABASE_URL into a ticket, a chat, or a client. On the legacy Neon database, that string is enough to connect.
Auth
The UI hides a page, and the API does not
The admin screen is hidden unless a localStorage flag is set. The request that loads the data still succeeds without that flag.