replit-policy-guardrails

# Replit Policy Guardrails ## Overview Policy enforcement for Replit-hosted applications. Replit's public-by-default Repls, shared hosting, and resource limits require specific guardrails around secrets exposure, resource consumption, deployment security, and endpoint protection. ## Prerequisites - Replit account with Deployment access - Understanding of Replit's security model - Awareness of Replit's Terms of Service ## Instructions ### Step 1: Secrets Exposure Prevention Replit Repls are **public by default** on free plans. Source code is visible to anyone. ```python # CRITICAL POLICY: Never hardcode secrets in source files # BAD — visible to anyone viewing your Repl API_KEY = "sk-live-abc123" DB_PASSWORD = "p@ssw0rd" # GOOD — use Replit Secrets (AES-256 encrypted) import os API_KEY = os.environ.get("API_KEY") if not API_KEY: raise RuntimeError("API_KEY not set. Add it in the Secrets tab (lock icon).") # Startup validation — fail fast if secrets missing REQUIRED_SECRETS = ["API_KEY", "DATABASE_URL", "JWT_SECRET"] missing = [s for s in REQUIRED_SECRETS if not os.environ.get(s)] if missing: raise RuntimeError(f"Missing required secrets: {missing}") ``` **Automated secret detection:** ```typescript // Pre-deploy check script: scripts/check-secrets.ts import { readFileSync, readdirSync, statSync } from 'fs'; import { join } from 'path'; const SECRET_PATTERNS = [ /sk[-_](?:live|test)[-_]\w{20,}/, // API keys /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]+...