Replit Agent is genuinely impressive at getting from a prompt to a running, hosted app in one session — it provisions the database, wires up auth, and deploys it, all inside the same workspace. That convenience is also where the risk hides: a lot gets set up automatically, and it's easy to assume "automatically" means "correctly."
The pattern we see most is an app that's functionally complete and structurally tied to Replit in ways nobody decided on purpose — storage that won't hold up at scale, and no real path off Replit's hosting once traffic actually requires one.
The Replit-specific issues we see most
Built-in auth assumed sufficient without server-side verification on custom endpoints added later
Replit's key-value storage used for data it was never meant to hold at production scale or query patterns
The app is structurally tied to Replit hosting, with no plan for what happens when it needs to move
Secrets duplicated between the Secrets panel and code left over from earlier agent iterations
Deployments triggered ad hoc from the workspace, with no CI and no rollback path if one goes wrong
Leftover artifacts from agent iteration — commented-out attempts, dead routes — that never got cleaned up
No real environment separation — the same Repl often serves as both development and "production"
A checklist you can run yourself
Give this a real go before reaching out — the people who can fix it themselves were never going to hire us, and the ones who read it and realise the scale of the job usually do.
Open any custom API route you added after the initial build and confirm it checks who's calling it — don't assume Replit's auth covers routes you wrote yourself.
Check what you're storing in Replit's built-in database or key-value store, and whether it was ever meant to hold that volume or be queried that way.
Search your code for secrets that exist both in the Secrets panel and hardcoded from an earlier iteration.
Ask what your plan is if you outgrow Replit's hosting — if there isn't one, that's worth having before you need it urgently.
Look for commented-out code and unused routes left over from earlier agent attempts, and clean up what's dead.
Confirm you're not running development and production out of the same Repl with the same database.
Trigger a deployment and check whether you have any way to roll it back if it goes wrong.
When to get help
Worth getting a second pair of eyes on this once real users are on it, payments are involved, you're handling anyone's personal data, or someone other than you will need to maintain this going forward. Below that bar, the checklist above will get you most of the way.
Read the full AI app rescue guide, or see the checklist for Bolt, Lovable, v0 or Cursor.