New Workspace feature keeps API keys safe

Replit has introduced a new Workspace security feature to prevent users from mistakenly entering sensitive information like API keys directly into code.

The core feature, Secret Scanner, detects in real time when a user attempts to paste an API key or token into a file. This scanner operates based on known API key patterns and regular expressions (regex), and runs client-side for enhanced security.

Key features include:

• Warnings are displayed via Ghost Text and tooltips, allowing users to immediately save the value as a Secret or dismiss the warning and continue pasting. This prevents sensitive information from remaining in file history.
• Data stored in Secrets is encrypted with AES-256, and the encryption keys are protected by a multi-layered security system.
• The same security feature is available not only on the web but also in the Replit Mobile App.

Since its launch, this feature has achieved the result of preemptively blocking more than 500 API keys from being exposed in open source.