Turn on SSO, restrict public publishing, require a Git remote and a security scan, and approve models per Workspace before people across the company publish apps on Replit. Each control is a Replit Enterprise setting documented on docs.replit.com as of October 2026.
When you need this
- Security asks who can publish an app to the public internet from a company account.
- Apps built on Replit hold customer or employee data.
- You need proof of who changed what, streamed into your SIEM.
- Your policy limits which AI providers and models may process company data.
Security review checklist
Identity
Does every builder sign in through your identity provider?
SetSet up SAML SSO with Okta, Microsoft Entra ID, or another provider, and claim your email domains so anyone signing up on them must use SSO. SCIM provisioning maps identity provider groups to Workspaces and roles. Replit does not expand nested Entra ID groups, so use flat groups.
Publishing
Who may publish public apps, and are development URLs protected?
SetSet Private deployments to Require, or Require for non-admins, and review project exceptions under Public publishing exceptions. Private deployments covers only apps published after you set it, so review apps already live one by one. Turn on Require private development URLs so apps in progress need sign-in. That setting also covers existing apps.
Data and code leaving the platform
Can code or files leave through export or uploads, and where may apps run?
SetBan source code export and attachment uploads where policy requires it. The export ban stops ZIP downloads of source code, and Replit's docs warn that code can still leave through other routes. Pin deployment geography. It governs where the deployment runs, and external databases or APIs the app calls keep their own locations.
Source control
Must every change be in your Git history before it goes live?
SetTurn on Require Git remote, so apps push changes to a remote before publishing, and set Private remotes to Require for all. Require Git remote applies only to apps published after you enable it.
Security scans
What blocks a vulnerable app from publishing?
SetTurn on Require security scan during publishing and set Block publishing at severity to the level your policy accepts. It defaults to Critical only. Turn on Auto-Protect to prepare patches for newly disclosed CVEs (published vulnerability records), and send security alerts to a shared list. Dependency scans are free, and Replit bills the patches it prepares like other development work. A clean scan covers known package vulnerabilities only, so the app's own code still needs review.
Models, logs, and training
Which providers process prompts, and what is recorded?
SetApprove providers and models per Workspace. Replit requires at least one model each from OpenAI, Anthropic, and Google to stay enabled. Restrict fast models and higher Effort if your policy calls for it. Enable audit logs and stream them to Datadog, Splunk, Amazon S3, or an HTTP endpoint. Replit does not use Enterprise customer content to train its models.
Questions to settle before rollout
- Which email domains do we claim for SSO, and which identity provider groups map to which Workspaces?
- Is public publishing allowed for anyone, admins only, or by project exception?
- Which scan severity blocks publishing, and who receives security alerts?
- Which model providers are approved for company data?
- Where do audit logs go, and who reviews them?
Red flags
- Public publishing open to every builder on a company account.
- Development URLs reachable without sign-in.
- No Git remote requirement for apps that hold customer data.
- Treating a clean dependency scan as a security review of the app.
Products in this piece
Sources
- Official documentation
- 11
- Public source
- 2
- Replit docs: Single sign-on (SAML SSO)
- Replit docs: SCIM
- Replit docs: Privacy and deployment settings
- Replit docs: Source control settings
- Replit docs: Enterprise security
- Replit docs: Agent modes and models for Enterprise
- Replit docs: Audit logs
- Replit docs: Advanced settings
- Replit docs: Model improvement
- Replit docs: Information security
- Replit docs: Security checklist
- Jason Lemkin, SaaStr: We've Now Shipped 3 Vibe Coded Apps to Production (published Aug 25, 2025)
- Jae, DEV Community: I vibe-coded a full-stack AI product in 10 phases (published Apr 9, 2026)