Blog

Introducing Replit Auto-ProtectIntroducing Replit Auto-Protect — cover image

Published:

Apr 22, 2026The Replit Team

The Replit Team

Modern applications rely heavily on external packages, often open source and maintained by third parties. When new vulnerabilities - tracked as CVEs (Common Vulnerabilities and Exposures) are disclosed, teams need to act quickly before they can be exploited.

Previously, staying secure required builders to monitor CVEs constantly and manually update dependencies. Now, Replit handles this for you. When a new critical CVE is identified, we automatically check it against your project’s dependencies. If a match is found, once you’ve opted in, we will:

  • Have Replit Agent automatically prepare and test a patch
  • Send you a direct link over email to apply the change proposed in the patch

This new workflow allows you to keep your apps safe in two clicks: one to apply changes from the patch, another to republish your app.

security identifier

Getting started is straightforward. The email notification links you directly to the “Security Center” pane of the affected project, where you can review and apply the proposed patch immediately.

security center

If you want to inspect the changes before applying them, select “Go to Task” to see the full contents of the patch. Once applied, the patch is merged into the main branch of your preview environment. At this time, your project’s Security pane will reflect vulnerabilities as pending republish. You should always republish to ensure your production application is secure.

security pane

To opt-in to Replit Auto-Protect, you need to be an admin in your account. Then:

  1. Go to “Account > Advanced” under Settings. From here, you can select the minimum severity level (low, medium, high, or critical) at which you'd like Replit to automatically prepare security remediations. This setting will be off by default for our initial launch.
  2. Go to “Personalization > Email Notifications” under Settings. From here, you can select the minimum severity level (low, medium, high, or critical) at which you’d like Replit to notify you when there is a newly reported security issue. This setting will be off by default for our initial launch.

Regardless of whether or not you opt-in, when a new CVE is identified, we will always automatically check it against your project’s dependencies to find matches. You can find the latest state of your projects at scale from your team’s Security Center.

More