Skill UI

This comprehensive guide provides a detailed framework for optimizing spending across Replit services. Learn how to conduct a thorough billing audit, right-size deployment resources (Autoscale vs. Reserved VM), manage data egress costs, optimize team seat licenses, and clean up idle resources. Essential for controlling cloud spending and ensuring efficient resource allocation in any development workflow.

A comprehensive guide for configuring and managing organizational access control in Replit Enterprise. This skill covers defining role hierarchies (Owner, Admin, Manager, Editor, Viewer), implementing custom groups, integrating Single Sign-On (SSO/SAML), restricting deployment permissions (Production/Staging), and setting up detailed audit logging. Use this when securing a large development team, setting up strict security policies, or performing quarterly access reviews.

This guide identifies and explains common anti-patterns and critical pitfalls encountered when building applications on the Replit platform. Topics include data persistence, secret management, networking bindings, and environment configuration. Use this resource when conducting code reviews, onboarding new developers, or auditing existing Replit applications for best practices.

This skill provides comprehensive guardrails for securing Replit-hosted applications. It covers critical security policies including preventing hardcoded secrets, implementing resource usage limits (CPU/Memory), enforcing endpoint authentication, and ensuring proper deployment configuration. Use this when you need to harden a Replit app for production or audit its security posture.

A comprehensive guide detailing security best practices for building and deploying applications on the Replit platform. Learn how to properly manage sensitive data using Replit Secrets (AES-256 encryption), implement secure service-to-service authentication via REPL_IDENTITY tokens, validate custom headers, and prevent common vulnerabilities like hardcoded API keys and SQL injection. Essential for auditing and securing production environments.

This comprehensive tool validates web applications against WCAG 2.1/2.2 accessibility standards. It combines automated scanning using industry-leading tools (like axe-core, Lighthouse) with crucial manual checks for keyboard navigation, ARIA implementation, and color contrast. It is essential for QA teams and developers who must ensure high usability and accessibility for all users, including those relying on screen readers.

A comprehensive tool for detecting critical API security vulnerabilities, including injection, broken authentication (BOLA), excessive data exposure, and mass assignment. It audits endpoints against the OWASP API Security Top 10 standards by analyzing source code, middleware chains, and request validation logic. Ideal for pre-deployment security gates, CI/CD integration, and compliance audits.

Conducts detailed accessibility audits for web apps via the accessibility-test-scanner plugin, verifying WCAG 2.1/2.2 compliance, ARIA usage, keyboard navigation, and screen reader compatibility while providing remediation guidance when accessibility or compliance checks are requested.

Automatically scans code and configs using the data-privacy-scanner plugin to flag sensitive data exposure and compliance violations for privacy audits.

Automatically scans code for reflected, stored, and DOM-based XSS risks across HTML, JavaScript, CSS, and URLs, providing reports and safe proof-of-concept payloads for use in reviews, audits, or pre-deployment checks.

Automatically scans code for missing or weak input validation, highlighting potential XSS, SQL injection, or command injection risks so developers can harden their applications during reviews or audits.

A comprehensive guide to implementing secure secrets management practices for Continuous Integration/Continuous Deployment (CI/CD) pipelines. It covers using industry-leading tools like HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager to securely store, retrieve, and automatically rotate credentials (API keys, database passwords, TLS certificates) without hardcoding them into source code. Includes best practices for least-privilege access and audit logging.