Replit Agent Security: Lessons from the Database Deletion Incident

# SECURE: Use environment variables for config
import os
from flask import Flask

app = Flask(__name__)
app.config['DEBUG'] = os.environ.get('FLASK_DEBUG', 'False') == 'True'

if __name__ == '__main__':
    # Production should have FLASK_DEBUG=False
    app.run(
        host='0.0.0.0',
        debug=app.config['DEBUG']
    )

// SECURE: Use Replit Secrets
const mongoose = require('mongoose')

// In Replit, set MONGODB_URI in Secrets tab
mongoose.connect(process.env.MONGODB_URI)
  .then(() => console.log('Connected to database'))
  .catch(err => console.error('Connection failed'))

// The Secrets tab encrypts values with AES-256
// Never commit credentials to code

# MITIGATION (now automatic in Replit)

Replit now automatically:
1. Separates production database from development database
2. Prevents development environments from accessing production
3. Previously required manual configuration

Best practices:
- Always use separate databases for dev/staging/prod
- Never give AI agents write access to production
- Use read-only replicas for AI-assisted development
- Enable backups before any AI modifications

// SECURE: With HTTPS redirect and security headers
const express = require('express')
const helmet = require('helmet')

const app = express()

// Security headers
app.use(helmet())

// HTTPS redirect in production
app.use((req, res, next) => {
  if (process.env.NODE_ENV === 'production' &&
      req.headers['x-forwarded-proto'] !== 'https') {
    return res.redirect(`https://${req.headers.host}${req.url}`)
  }
  next()
})

app.listen(3000)

# SECURE: With validation using Pydantic
from flask import Flask, request, jsonify
from pydantic import BaseModel, EmailStr, validator
from typing import Literal

app = Flask(__name__)

class UserCreate(BaseModel):
    name: str
    email: EmailStr
    # Role is fixed - users can't set their own role
    role: Literal['user'] = 'user'

    @validator('name')
    def name_not_empty(cls, v):
        if not v or len(v) > 100:
            raise ValueError('Name must be 1-100 characters')
        return v.strip()

@app.route('/api/user', methods=['POST'])
def create_user():
    try:
        user = UserCreate(**request.json)
    except Exception as e:
        return jsonify({'error': 'Invalid input'}), 400

    db.users.insert_one(user.dict())
    return jsonify({'success': True})