Introducing Replit Security Agent

Replit Security Agent provides app-wide security reviews. Previously, pre-launch security checks took weeks — coordinating security engineers, reviewing reports, and manual fixes — but now a comprehensive review can be completed in under 1 hour.

The agent analyzes the entire codebase based on a customizable threat modeling plan, and combines Semgrep and HoundDog.ai to improve detection accuracy. Replit explains that this approach is backed by recent research and its own whitepaper findings showing that LLM-based agents can filter out up to 93.3% of false positives from deterministic SAST tools.

The workflow is as follows:

• Select "Run Scan with Agent" in the Security panel
• Map the architecture and build a threat model
• Analyze routes and APIs
• Check for vulnerabilities such as SQL injection, XSS, and request forgery, and verify whether they are actually exploitable in production

For large projects, this in-depth audit can take up to 15 minutes. Once the review is complete, a report is generated, and users can ignore or fix the findings, then hand off approved issues to Replit Agent for automatic fixes.

Fixes are split into separate tasks and processed in parallel; after patches are applied, they must be reflected on the main branch and republished. The Security pane then marks the vulnerabilities as resolved, and Replit recommends rescanning with Security Agent after every major change.