Directory / Replit Agent
Replit Agent
Automatic checkpoints cover files, config and optionally the database, and you can roll back to any of them. Production databases are kept separate from the dev database.
Lock this down first
Keep production data in the separate production database and never point the agent's dev environment at it.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | Unverified | Not confirmed in the docs we checked. |
| Human approval gates | 2/3 | You approve sensitive actions like deploys and secret changes. |
| Sandboxing | Unverified | Not confirmed in the docs we checked. |
| Secrets handling | 2/3 | Secrets tool stores values as env vars, kept out of code. |
| Audit logs | 2/3 | Checkpoints give a restorable history of agent changes. |
| Kill switch / interrupt | 2/3 | Stop button in the Agent panel. |
| Network egress control | 2/3 | Agent has restricted outbound access while editing. Published apps are not restricted. |
Sources
- https://docs.replit.com/features/version-control/checkpoints-and-rollbacks
- https://replit.com/blog/doubling-down-on-our-commitment-to-secure-vibe-coding
- https://docs.replit.com/help/agent-and-ai
- https://docs.replit.com/core-concepts/project-editor/app-setup/secrets
- https://docs.replit.com/features/security/shared-responsibility-model
Vendor? Request a correction. We review corrections within 7 days.