Introducing Replit Auto-Protect

Replit Auto-Protect is a feature designed to protect apps with many external package dependencies, such as open source, from CVE vulnerabilities more quickly. When a newly disclosed critical vulnerability matches a project's dependencies, if the user has opted in, Replit automatically prepares and tests a patch, then sends an email with a link to apply it.

With this flow, managing app security can be completed in two clicks: one to apply the patch suggestion, and one to republish the deployment.

Here's how it works.

• The email notification takes you directly to that project's Security Center.
• Selecting Go to Task lets you first review the full contents of the patch.
• Once the patch is applied, the changes are merged into the main branch in the preview environment.
• After that, the Security pane shows it as needing republishing, and you must republish to keep production safe.

Only account admins can configure the opt-in settings. In Settings > Account > Advanced, you can choose the minimum severity level for automatic security fixes from low, medium, high, critical, and in Settings > Personalization > Email Notifications, you can set the severity threshold for vulnerability alerts in the same way. Both settings are off by default at initial launch.

Regardless of opt-in status, whenever a new CVE is confirmed, Replit always checks it against project dependencies for matches. At the team level, the Security Center provides a single view of the latest security status across multiple projects.