Replit adds black-box pen tests and sends Agent to patch the holes
Level 3 scans test a sandboxed copy from inside and outside the codebase, then hand confirmed findings to Replit Agent for reviewable fixes.
By RuntimeWire Staff · Published
Primary source: Replit
Why it matters
Replit is pulling security testing into the prompt-to-production loop it sells to non-specialists. That reduces handoffs and makes scan accuracy central to customer trust.
Replit, founded by Amjad Masad and Haya Odeh, added black-box penetration testing on August 17, giving its AI app builder a way to probe published applications from an attacker's perspective and pass confirmed findings to Replit Agent for proposed fixes. Replit introduced the feature in a thread on X and an accompanying product post by member of technical staff Alexandre Cuoci.
The release extends the founding bet Masad and Odeh have pursued since Replit's earliest browser-based programming environment: reduce the specialist work standing between an idea and functioning software. Masad grew up in Amman, Jordan, later becoming Codecademy's founding engineer and working on JavaScript infrastructure at Facebook. Odeh designed Replit's first logo and interface after joining the original project. Their accessibility thesis now carries a harder obligation. When people can generate and publish apps holding customer data in a day, security work has to move at roughly the same speed. (Amjad Masad's biography)
Replit is trying to keep that work inside the same loop as prompting, building, hosting and publishing. A user launches a Level 3 scan from a project's Security Center. Replit then runs a white-box scan with access to the source code alongside a black-box scan that receives only the application's link. Replit says both scans target a full copy of the application inside a private sandbox, keeping the tests away from production users. (Replit's black-box pen-test announcement)
An agent with the app's URL and no inside information
The black-box scanner clicks through the application while observing its network requests. It first tests what an unauthenticated visitor can reach, then signs in as an ordinary user to check whether that account can access another user's records or restricted administrative areas. Replit says the scanner also identifies the technologies behind an application and tests failure modes associated with that setup. (Replit's black-box pen-test announcement)
Replit's examples show why the two perspectives can diverge. A white-box scan found a logic flaw that allowed a user with revoked access to continue operating because the application failed to recheck an old session. The black-box scan found a separate admin dashboard at a predictable address with no authentication. In another Replit-built multiplayer game, the external scan found an endpoint that could be flooded to crash an active match. Replit says the code scanner missed those runtime exposures because the underlying source did not appear defective on its own. (Replit's black-box pen-test announcement)
The findings feed directly into Replit Agent, which prepares patches for the user to inspect. Replit keeps a human approval step before changes return to the main project, and the user must republish the application for the fixes to reach production. That review requirement matters because an automated patch can change permissions, request handling or application behavior in ways that need product context, even when the vulnerability itself is real. (Replit Security Agent)
Replit now describes three levels of ad hoc scans. Level 1, which Replit says is free, covers dependency checks and static analysis. Level 2 adds the deeper white-box agent review. Level 3 runs both white-box and black-box agents. Replit also layers in its Auto-Protect controls, including a malicious-package firewall, a web application firewall and SSL/TLS encryption. (Replit's black-box pen-test announcement)
Security becomes part of the app builder
Masad's larger strategy is to make Replit the place where the entire software lifecycle happens. RuntimeWire reported in June that Replit was pushing Agent beyond code into websites, mobile apps, pitch decks and launch videos. In July, Replit added an AI design suite with Figma imports, screenshots and reusable design systems. Black-box testing applies the same consolidation strategy to a task that founders have traditionally handed to security vendors.
Replit began assembling that security layer before this week's release. On April 21, Replit launched a white-box Security Agent that maps an application's architecture, creates a threat model and checks routes and APIs for issues such as SQL injection, cross-site scripting and request forgery. In May, Replit expanded its Security Center so organizations could review vulnerabilities across multiple projects, unpublish exposed applications and ask Agent to prepare per-project fixes. (Replit Security Agent)
The commercial incentive is straightforward. Replit wants people with limited engineering experience to publish software that handles real users, payments and internal data. Every additional production workload increases the value of Replit's hosting and agent credits, while raising the consequences of insecure generated code. Security cannot remain an optional handoff if Replit wants its prompt-to-app workflow used for serious operations.
That pressure grew with Replit's March 11 financing. Replit said it raised $400 million at a $9 billion valuation, led by Georgian and backed by G Squared, Prysm Capital, Coatue, Andreessen Horowitz, Craft Ventures, Y Combinator and several strategic investors. Masad also said Replit had more than 50 million users, users inside 85% of Fortune 500 companies and a goal of reaching $1 billion in run-rate revenue by the end of 2026. Those are Replit's figures and target. They explain why security has moved from a supporting feature into a central product surface. (Replit's $400 million financing announcement)
Replit is entering a security category that already includes specialists. Aikido Attack markets autonomous penetration tests, exploit validation and AI-generated fixes, while Terra Security combines continuous agent testing with a human pentester overseeing sensitive actions. Replit's distribution advantage is placement: the scan, source code, hosting environment and remediation agent already sit inside the product where an application was built. Aikido and Terra, in turn, sell deeper security programs across code, cloud, networks and production environments.
Replit's launch post provides individual findings rather than measured detection rates. Security buyers still need to establish the scan's framework coverage, false-positive and false-negative rates, usage limits and reliability across larger applications. Replit also has not presented an independent evaluation of the black-box agent or quantified how often Agent's proposed fixes require manual changes. The sandbox reduces operational risk during testing; it does not establish that the scanner will find every exploitable path.
Still, the direction follows Masad's original thesis closely. His stated ambition is to bring the "next billion software creators" online. Those creators will need authentication, authorization, dependency checks and adversarial testing without assembling a security department first. Replit is betting that the agent which writes the application can also coordinate its first security review, explain the holes and prepare the patch. The durability of that bet will depend on whether the closed loop produces secure software, rather than merely faster software with a reassuring scan report. (Amjad Masad's biography)