We Got Breached

Replit receives numerous vulnerability reports, but most are low-level reports based on a misunderstanding of RCE (Remote Code Execution), which is a core feature of the service. In response, Replit has operated a bounty program offering a clear goal and a $1,000 reward to encourage meaningful vulnerability discovery.

Recently, a user named PDanielY, while testing the closed-alpha developer API, discovered an actual security vulnerability. The issue stemmed from a design flaw in the token minting code.

The specifics of the vulnerability are as follows:

• Token minting used a method that had long been deprecated.
• Instead of creating a temporary fork when accessing another user's repl, it granted full access to that repl.

As soon as Replit discovered this, it invalidated all developer tokens and investigated the logs, and fortunately no additional cases of exploitation were found. Still, as a precaution, users who had stored secrets in files such as .env were advised to regenerate their credentials.