Replit just published a full defense-in-depth security walkthrough — the kind of document security teams ask for before approving a platform, and the kind vibe coders rarely think about until something breaks.
The core argument: every layer where customer code runs, from development sandbox to production deployment, needs its own security boundary. Replit’s architecture treats AI-generated code with the same suspicion as human-written code — maybe more, since agents can pull in dependencies and spin up services faster than any reviewer can audit.
The post covers several distinct layers:
- Tenant isolation — each workspace runs in its own sandboxed environment, preventing one user’s code from reaching another’s data or compute
- Supply chain protection — controls around which packages and dependencies AI agents can pull in, reducing the blast radius of a compromised library
- Continuous testing — automated security checks that run against deployed code, not just at build time
- Enterprise-grade controls — admin-level policies for teams that need compliance guardrails on top of the platform defaults
This matters because vibe coding shifts the trust model. When a developer writes code line by line, they at least see every dependency import and API call. When an AI agent scaffolds an entire app from a prompt, the attack surface expands in ways that are hard to reason about manually. Replit is betting that the platform layer — not the individual developer — is where security enforcement has to live.
NOTE
Replit raised a $400M Series D at a $9B valuation earlier this year, with investors including a16z, Coatue, and Databricks Ventures. Enterprise security credibility is table stakes at that valuation.
The timing tracks with a broader pattern: Cursor, Windsurf, and GitHub Copilot Workspace are all adding workspace-level guardrails as AI agents gain more autonomy. The platforms that ship security architecture docs — not just feature announcements — are the ones enterprise buyers will shortlist.
The full walkthrough is also mirrored at replit.com/security — worth bookmarking if you’re evaluating Replit for a team deployment or need to hand something to your infosec reviewers.