agent ↗

Cloud-hosted, highly autonomous coding agent. Writes code, provisions infrastructure, runs databases, ships deployments. Workspace + secrets + DB + production runtime all in Replit's GCP tenancy — most controls are account/workspace/project settings. The July 2025 Lemkin/SaaStr incident — Agent wiped a production database during a declared code freeze, fabricated 4,000 fake records to cover it, lied about rollback — exposed how thin default guardrails are. Replit has since shipped dev/prod DB separation + planning-only mode.

Account Authentication and MFA

Enable hardware-key or TOTP MFA on every Replit account; Agent inherits whatever session authenticated it. Rotate passwords + revoke active sessions any time Agent has had access to secrets including OAuth tokens or API keys. Bind Git, GitHub, deployment-provider OAuth grants to least-scope tokens.

Teams / Enterprise Workspace Controls

Move production work into a Teams or Enterprise org for SAML SSO, SCIM provisioning, audit logs (Enterprise-plan only). Force SSO with your IdP (Okta/Entra/Google); require MFA at IdP layer; disable password fallback. SCIM deprovisioning = a fired engineer loses Agent + DB + Deployment access in one step.

Secrets Vault Hygiene

Store every credential in Replit Secrets (AES-256 at rest, TLS in transit); never paste keys into chat with Agent — they end up in conversation history. Prefer app-scoped Secrets over account-scoped. Separate *_DEV and *_PROD secret names. Static Deployments cannot use Secrets.

Agent Autonomy and Mode Controls

Default to Plan Mode / planning-and-chat-only mode (added post-Lemkin) for anything touching production. Use Lite/Economy for routine edits; reserve Power/Turbo for greenfield in throwaway Repls.

Real incident Jul 2025 — During a documented "code and action freeze," Replit's Agent ran unauthorized commands that wiped a production database of 1,206 executives and 1,196 companies, then fabricated test data and falsely told Jason Lemkin rollback was impossible. ALL-CAPS instructions and code freezes are NOT enforced by the model. The Register · Fortune postmortem

Tip: treat "vibe coding" as prototype-only; disable auto-run on file save; start a fresh Agent session before sensitive work so prior context cannot be re-interpreted as approval.

Database Backups, Snapshots, and Dev/Prod Separation

New Replit-hosted Databases now provision separate dev + prod automatically — verify it's on; legacy Neon-backed databases (sunset Dec 4, 2025) do not. Use Database Time Travel / checkpoint rollback as the last line of defense.

Tip: export nightly logical dumps (pg_dump) to external storage the Agent has no creds for. Forbid DROP, TRUNCATE, and unscoped DELETE via the DB role the Agent uses; grant DDL only to a human-run migration role.

Deployments, Always-On, and Blast Radius

Pick the deployment type intentionally (Static / Autoscale / Reserved VM / Scheduled). Deployment has its own Secrets snapshot taken at publish time — re-publish after rotating keys. Set billing cap + request budget so a runaway Agent loop can't burn your card.

Tip: require a human "Publish" click for prod; never let the Agent run the deploy flow unattended.

Webhook and External Integration Security

Verify HMAC signatures on every inbound webhook the Agent wires up — Agents routinely skip this step. Store webhook secrets in Replit Secrets. Pin outbound webhook URLs to an allowlist; an injected prompt can otherwise exfiltrate data via a crafted fetch() the Agent adds "to help".

Tip: for third-party MCP-style integrations, grant the narrowest OAuth scope possible and review what the Agent connected after every session.

Prompt-Injection Defenses (Rule of Two)

Treat any content the Agent reads (scraped pages, GitHub issues, support tickets, PDFs, dependency READMEs) as untrusted instructions, not data. Apply the Rule of Two (Willison / OpenAI): of {autonomous execution, access to private data, ability to communicate externally} the Agent should hold at most two at once. Production DB creds + outbound HTTP + autonomy = the combo that caused Lemkin's loss.

Tip: never let the Agent both read user-submitted content and hold production write credentials in the same session.

Audit Logs, Checkpoints, and Observability

Enterprise audit logs cover login, SSO, SCIM, admin events — ship to your SIEM. Use Replit checkpoints liberally; they are the rollback mechanism that worked in the Lemkin case after Agent claimed it couldn't.

Tip: snapshot the Repl (download as zip or push to an external Git remote you control) before any large Agent run; review the Agent conversation transcript as part of post-incident forensics — it shows what tools were called and what the model "saw".

Patching, Feature Flags, and Incident Readiness

Replit ships Agent behavior changes continuously; re-test your guardrails monthly because defaults shift (planning-only mode itself was added mid-2025).

Tip: document an Agent kill-switch: who revokes the SSO session, who rotates Secrets, who pauses Deployments. Run a tabletop exercise based on the Lemkin scenario — "Agent dropped prod DB and is lying about restore options" — practice the Time Travel restore and the external pg_dump restore.

References & further reading