Agent Habitat Architecture
A proposed security architecture and maturity scale for agent habitats, covering identity, execution, permissions, data flows, approvals, and recovery.
Articles
AI adoption starts with truth
AI adoption is limited by trust. A user who gets burned by a confidently wrong answer will double-check the next one, eventually routing consequential work around the system entirely. Once that happens, AI remains a tool at the edges rather than infrastructure at the center… useful, but never trusted with the workflows where its value compounds. Before a company can benefit from more capable agents, those agents need a reliable way to know what the company considers true.
Closing the loop: Evaluating and improving Replit Agent at scale
Most Replit Agent users start with an idea. They describe the goal in natural language — without a repo, test suite, or chosen framework — and expect the agent to turn it into a functioning app. The result might be a website, slide deck, mobile app, several connected artifacts, or something else entirely.
We Built a Video Rendering Engine by Lying to the Browser About What Time It Is
How Replit turns any web page into a deterministic video by virtualizing time itself, patching key browser audio APIs, and waging war against headless Chrome's quirks.
Decision-Time Guidance: Keeping Replit Agent Reliable
Replit Agent stays reliable through decision-time guidance—injecting situational instructions at key moments rather than front-loading all rules.
![Cover artwork for the article “How Replit Secures AI-Generated Code [white paper]”.](https://cdn.replit.com/engineering-blog/v1/images/795091fa15707937848fcd8cb13ac016459b4911543e3457d14280dee377c800.webp)
How Replit Secures AI-Generated Code [white paper]
AI security scans alone aren't enough. New research shows hybrid approaches combining static analysis with LLM reasoning are essential for vibe coding.
Inside Replit’s Snapshot Engine: The Tech Making AI Agents Safe
How Replit's snapshot engine makes AI agents safe: instant filesystem forks, versioned databases, and isolated sandboxes enable reversible AI development.
Enabling Agent 3 to Self-Test at Scale with REPL-Based Verification
How Replit built a novel REPL-based verification system that combines code execution with browser automation to catch "Potemkin interfaces", enabling Agent 3 to work autonomously for 200+ minutes.
Building Production-ready Apps with Automated Database Migrations on Replit
Learn how Replit automated database migrations between dev and production environments, enabling safe AI agent development with minimal user intervention.
Using Tvix Store to Reduce Nix Storage Costs by 90%
For the past few years, Replit has been using Nix to serve packages/dependencies and provide consistent development environments to our users. Nix on Replit allows users to have access to a large number of packages and libraries that can be seamlessly integrated into a user's project.
Introducing Workflows
With Workflows, you can easily save your development processes and organize them as a sequence of Tasks. Instead of having to repetitively type commands into your shell and remember them, Workflows provide an intuitive interface to configure your frequently used commands and execute them with the click of a button.
Replit's All-new Database Editor
This week, we launched a new Database Editor feature on Replit. This feature is another addition to Replit’s full suite of tools that make it easy for anyone to build an app — no coding knowledge required.
So you suspect you have a memory leak...
Programming languages with Garbage Collectors are fantastic! You no longer need to keep track of every single piece of memory that your program needs to run and manually dispose of them. This also means that your programs are now immune to bugs like double-free (accidentally freeing a resource more than once, leading to crashes or security vulnerabilities) and most memory leaks (accidentally not freeing a resource, leading to crashes by running out of memory). But it is still possible to have a memory leak. Consider this TypeScript snippet:
Shell2: 200× faster, persisted, multiplayer-native Shells
Back when computers were still in their infancy, the “computer” usually was a big cabinet in the middle of a room. They typically exposed some internals via a front panel with lots of knobs and ports. Users would connect a terminal device (sometimes called a teletype or a TTY) to this front panel in order to input text and print the corresponding output.
How Replit makes sense of code at scale
For any company making creative tools, being able to tell what its most engaged users are building on the platform is critical. When the bound of what’s possible to create is effectively limitless, like with code, sophisticated data is needed to answer this deceivingly simple question. For this reason, at Replit we built an infrastructure that leverages some of the richest coding data in the industry.
Improved Dependency Management
We recently revamped the dependency management experience in your Replit workspace. You can now use and configure multiple languages in one Repl. We’ve consolidated language support, packages, and system dependencies into one new Dependencies pane for beginners and experienced developers alike!
Advanced port configuration
We recently spent a few months making ports easier to work with on Replit, so you can develop more complex apps predictably.
Searching Nixpkgs in Under 30 Milliseconds
Today, we’re releasing the first version of rippkgs, a CLI utility for indexing and searching Nix expressions. With rippkgs, you can quickly search the nixpkgs available to your system with accurate results. Read on for more details about why we created it, how to use it, and how it works.
Replit + pip
We’re thrilled to announce that first-class pip support is now available on Replit! This should work out-of-the-box when importing existing repositories from GitHub. For developers who want to switch from poetry to pip: start by deleting poetry.lock, then move your dependencies over from [tool.poetry.dependencies] to requirements.txt (structure hint: flask = "^3.0.2" would become flask>=3.0.2,<4 in requirements.txt), and finally, delete the other [tool.poetry...] sections from pyproject.toml. After that, the packaging infrastructure will use pip for all future operations going forward.
Easier Editing for .replit Files
At Replit, we want to make it easy to support any project configuration possible. This includes ensuring your binaries are in the right place and intelligent code completion works. Historically, the .replit file has been at the center of this, but the experience of editing the file is a process shrouded in mystery. While documentation exists for the file and what various configurations imply, it’s much more convenient if the documentation is visible inside the Workspace.
Landscape or Portrait? You Decide
People have expected apps to rotate with their mobile devices since before the introduction of the iPhone in 2007. It’s especially important for productivity apps to adapt and let people choose how they want to utilize their screen space. With the newest version of the Replit Mobile App, you can now code in both landscape and portrait modes. This creates a significantly improved experience on smaller tablets like the iPad mini or larger phones like the Pixel Fold. Want to code on the go with your iPad mini? Simply rotate it to portrait, then later, when you’re home, connect it to your wireless mouse & keyboard and rotate it to landscape for maximal screen space. This is the first of many more improvements to the Replit Mobile App, unlocking your ability to build and launch your next startup from your phone.
Dec 12 Incident Update: Secrets and repl.co Static Hosting Unavailable
Between Dec 12 and Dec 16, Secrets in interactive Repls and files in our legacy repl.co static hosting were unavailable. The root cause was a configuration push to GCS storage that was misinterpreted as a request for all the files to be evicted from storage. Deployments and Secrets in Deployments were unaffected. We have since recovered all known user Secrets and instituted new data retention procedures in our storage systems to ensure that this issue doesn’t reoccur. This will allow us to have a faster recovery going forward. This post summarizes what happened and what we're doing to improve Replit so that this does not happen again.
GitHub x Replit Workflows: Enhancing Developer Productivity
As developers, we constantly seek tools that simplify our workflows and boost our productivity. We know that most code lives on GitHub, so we want to make running, maintaining, collaborating on, and deploying code from GitHub repositories effortless.
Skip the README, let us install for you
If you’ve ever tried to install a complex Python package, you know the pain of scouring the package’s README for the apt install or brew install commands necessary to bring in the system-level dependencies the package needs. This approach can be time-consuming and frustrating, especially when a cascade of errors indicates a missing system dependency — a pain point that isn't always immediately obvious.
New and Improved Console
The new Console has been launched for a while, bringing a whole new UI, persisted history of executions, metadata about the runs, and more!
System Dependencies on Replit
We recently released some improvements to our Packages tool, and now we're extending that work to bring a new System Dependencies tool to Replit, powered by Nix! Replit has bet big on Nix, and we're not slowing down. It's now easier than ever to leverage Nix's power with a brand-new user interface for adding, removing, and searching system dependencies.
Tabs and Spaces - Smarter Indentation
When you're programming, indentation is something you shouldn't have to think about, as an IDE should handle most of the details nowadays. With Replit, you don't have to think about what happens when you press tab. We're releasing a suite of new indentation and whitespace related features that will make the code editing experience even better.
Sep 29 Incident Update: Read-Only Repls
On Sep 29, we had a period of about 2.5h from 14:00 to 16:30 (Pacific Time), in which an incomplete build was pushed to our infrastructure that handles storing Repl data. This caused Repls opened during that time window to become read-only or stop working. Any Repl not opened during that timeframe was not affected. We have addressed the root cause, recovered 98% of the affected Repls, and continue to work on recovering the remaining 2%. We understand that your data not being available is unacceptable for both you and your users. This post summarizes what happened and what we're doing to improve Replit so that this does not happen again.
Changes to Hosting on Replit
We remain committed to providing a powerful free development experience to anyone who wants to code. This post is only about the hosting experience, which we are migrating to our new Deployments product.
Performance Mystery: Is Golang's Startup Time Slow?
Performance Mystery: Is Golang's Startup Time Slow?
Expand possibilities on Replit with Expandable Storage
Expand possibilities on Replit with Expandable Storage
Rebuilding the Replit Filetree for Superior Performance and Accessibility
Rebuilding the Replit Filetree for Superior Performance and Accessibility
Replit Deployments: 3x Faster and Even More Features
In April, we released Replit Deployments, the fastest way to go from software idea to production. We rebuilt our application hosting infrastructure for production-grade applications thanks to your feedback. In this post, we’ll highlight upgrades, bug fixes, and improvements to Deployments since initial release in April.
Replit Storage: The Next Generation
Repls today allow 256+ GiB of storage space, up from a historical 1GiB limit. This post is about the infrastructure that enabled that change.
June 6, 2023, Single-Sign-On Security Vulnerability
Earlier today, we emailed users about a security vulnerability affecting parts of our single-sign-on functionality. While we’ve fixed the vulnerability and have found no evidence of any exploit, we are publishing this post out of transparency.
Super Colliding Nix Stores: Nix Flakes for Millions of Developers
Super Colliding Nix Stores: Nix Flakes for Millions of Developers
How to train your own Large Language Models
Learn how Replit trains Large Language Models (LLMs) using Databricks, Hugging Face, and MosaicML
Replit Deployments - the fastest way from idea → production
Replit Deployments - the fastest way from idea → production
Hackers, Pros, and Teams users can now code for hours without restarts
Hackers, Pros, and Teams users can now code for hours without restarts
April 2 Potential GitHub Credentials Exposure
Yesterday, on April 2, 2023, Replit discovered a site vulnerability that may have exposed GitHub auth tokens for <0.01% of Replit users, stemming from use of the GitHub import feature. This could have permitted unauthorized read/write access to all the repositories of those users by default (users can choose to authorize just a subset of repositories).
Announcing Outbound Data Transfer Limits
Beginning April 7th, Replit will begin enforcing limits on the amount of outbound data that developers can transmit from their Repls to users and external services. Inbound data transfer is free.
Remote Access to Your Repls via SSH
Last week we announced the Pro plan to speed up your development with Replit's AI tools and an even more powerful Workspace.
Replit x Weights & Biases Machine Learning Hackathon Winners
Replit x Weights & Biases Machine Learning Hackathon Winners
Apply for Replit’s first Machine Learning Hackathon
Apply for Replit’s first Machine Learning Hackathon
Making Repl Identity More Accessible
In August last year, we announced Repl Identity, a signed identity for every Repl that your code can use to authenticate other Repls when communicating with your APIs and services.
Branching out the Filetree
The filetree is a central surface of the workspace which has long been under-leveraged to support the workflows of users. As part of our ongoing workspace revamp, we're shipping improvements to make the filetree more usable and powerful. These improvements include:
Worldwide Repls, part 2: Load balancing for fun (although not quite profit)
In our previous blog post about Worldwide Repls, we talked about how we revamped part of our infrastructure to build a new abstraction that allowed us to build other components on top of it: the control plane. In this entry, we'll talk about the very first thing we built on top: a load balancer.
History++ - A Better Way to Do Versioning
Have you ever had to start over on a piece of code because you overwrote something by accident? Made an edit, replaced it, and then wished you could go back?
Zero-Click Auth For Your Apps
Picture this: you've built an arcade game on Replit. Gamers playing your game will head to the repl's cover page and click "Run". They love your game, and they send you feature requests and ideas in the comments. Now, you want to keep track of high scores and add other social features to your game. This used to be a show-stopper: there was no way to verify the API requests coming in, so your high-score feature was either easy to spoof, or simply didn't get off the ground.
Revamping the GitHub Import Flow
Early last year, we made the announcement that our infrastructure and Repls now had Nix baked in. Just a few months ago, we announced all new Repls would be Nix-based. And today, we're happy to announce that our GitHub imports flow is now also powered by Nix!
Inspect your HTML/CSS/JS Repls with native DevTools
We recently launched a new Replit-native way to inspect and debug web pages you build on Replit. Whether you're learning the basics or hosting a rich application, quickly being able to inspect the console and DOM is critical to your workflow.
Leaky UIs
Building a robust and powerful UI without compromising on simplicity is complicated, and we're always exploring solutions that alleviate that problem. A few years ago, we rewrote our workspace architecture, and Amjad gave a talk about it. We're about to add a lot of firepower to our layout system (stay tuned!), but we noticed significant shortcomings in our abstractions. This blog post will outline the flaws and how the underlying data structure hurt the interactions. To keep this post concise, I will defer the reasoning behind the UI and UX to a future post.
Worldwide Repls, part 1: The Control Plane
During the ReplCon 2022 keynote, we announced that we were going to geo-distribute our infrastructure so that your Repls are much faster when accessed outside of the United States. The speed of electrons / light in a medium is a fundamental speed limit. Most of our users are several thousand kilometers away from the data centers where we host Repls (currently limited to the United States), so the round trip from them to the users' homes is going to necessarily take several hundred milliseconds just to traverse the series of tubes that is the Internet. Today, we have finished the first milestone to make this a reality, and that comes with some pretty neat side-effects!
Improving Domain Linking for Repls
For some time now, it's been possible to link your custom domain to your Repl. You buy that perfect domain name, connect it to your website hosted on Replit, and you're good to go! Custom domains help you create a unique home on the internet - for your blog, a product you're launching, or just a space to try new ideas.
We Built a Search Engine
For the past few months, we have been building a Replit-native search engine. It is remarkably powerful, and we are really excited for you all to try it out. We believe that you should be able to find anything on Replit in less than 30 seconds.
Escaping Dirty Pipe (a.k.a. CVE-2022-0847), mostly unscathed
You may have heard that there was a very critical Linux kernel vulnerability making the rounds. As with all important enough vulnerabilities, this one has a catchy name: Dirty Pipe (no logo, though). This blogpost attempts to explain how that vulnerability impacted Replit. The good news is that as far as we know, there weren't any successful exploitations of it!
Betting on CodeMirror
At Replit, our mission is to bring the next billion software creators online. In order to achieve that ambitious goal, we need to make sure that the experience of writing, running, and sharing code is as seamless as possible. At the heart of that experience is the editor itself. As a result, we dedicate a huge amount of time and energy to improving the stability, performance, and accessibility of our editor.
All New Repls are Powered By Nix
For the past year we have been working hard to integrate Nix into our platform and rebuild our existing language experiences with package from Nix. We are excited to announce that all new repls are now powered by Nix. In this post we'll talk about what this means for the future of the platform and all the work that it took to get here.
Announcing File Persistence in Hosted Apps… for Everyone!
Replit is your computer — for whatever you need to do. We announced last year that Hackers would be able to have their hosted apps be able to persist file changes since that made it possible to build a lot more apps. But we were not quite satisfied that only Hackers were going to get this new feature.
Making new Python repls 100x faster to start up
Python is currently the world's (and Replit's) most popular programming language. We've improved the Python experience during last year, with a Python package cache to make installs faster, and an integrated, multiplayer debugger to increase the understanding of what programs do. But there are still a few problems with Python. Packages are often very space-consuming, so they are installed into an ephemeral 2 GiB scratch disk to avoid filling up repl directories. Unfortunately this means that every time a Python repl starts, a lengthy package installation process must happen. This makes some Python repls take forever to start! Some other packages that have a large number of dependencies (like TensorFlow and Torch) were completely unusable because they don't even fit on the scratch directory.
Understanding Repl Resource Utilization
Every computer on earth needs these three essential resources in some form:
Going Where the Next Billion Creators Are
Mobile is the future of computing. But building good software creation tools for mobile devices is hard. Luckily, at Replit, we like to run toward the hard things.
Migrating our Web App from Heroku to GCP
After many years of running on Heroku, Replit has fully migrated to Google Cloud Platform.
Implementing RUI, Replit's Design System
At Replit, we have a small engineering and design team supporting millions of users. Our secret is investing in good tools that make us more productive. In this blog post we'll give you an insider look into how we implemented one such tool - the Replit design system (or RUI for short).
Repl Space and Templates
When we want to support a new technology, we're faced with the question: "Do we (the Replit team) build this capability into the Replit directly, or can our users add it themselves?". Usually, we want the answer to be the latter. Repls are like personal computers for your projects. And the more these personal computers can be customized, the more they'll be used in creative, unexpected ways.
Ace, CodeMirror, and Monaco: A Comparison of the Code Editors You Use in the Browser
We compare and contrast the top code editors that you use in your browser.
Will Nix Overtake Docker?
In many discussions about Nix, the comparison of Nix and Docker comes up frequently. This question could be dismissed by saying that Nix and Docker are different tools that solve different problems. One is a toolkit for building and deploying containers and the other is a package and configuration manager. However, these tools do have some overlap: they can both be used to create reproducible environments. A reproducible environment is one that can be recreated from scratch in an identical way (ideally bit-for-bit). Practically, this means having the same tools, versions, and configuration between the environments.
How to Set Up Your Own Mastodon Instance with Replit
With many development tools and even whole development environments moving to the cloud, Replit is at the forefront of this change.
Announcing File Persistence in Hosted Apps for Hackers
We mostly think of repls as being full computers in the cloud, and one of the goals of the platform team at Replit is to enable people to build almost anything in replspace. In the past, when a file was stored in a repl, it would only be saved when the editor was opened. This went against our goal and made it impossible to write certain servers that changed files at runtime. This was especially hard for newcomers, because that's the easiest way to persist information. Starting today, Hacker and Teams subscribers will be able to write services that accept file uploads or store data in a local database (think SQLite) or text file, regardless of how the repl was started.
Betting on Nix: donating $25K to the NixOS Foundation
As building software grows more like snapping Legos together, how people find and use those Legos becomes more important. That's why we are donating $25,000 to the NixOS Foundation and betting on Nix as the future of software distribution.
Solidity on Replit: Diving into Web3
Today, we're announcing our official Solidity development template. Solidity is the language used to create smart contracts, which are programs that run on the Ethereum blockchain. This is important for the Web3 commmunity because there's finally an accessible and collaborative way to learn Solidity, which will unlock thousands of new developers in the decentralized web.
A New Code Editor for Mobile - CodeMirror 6
Today, we are thrilled to announce CodeMirror as the new code editor on Replit for mobile devices. CodeMirror is a versatile code editor that has been specifically designed with mobile in mind, providing an excellent touchscreen experience. This change is the beginning of a focused effort on mobile development here at Replit; the editor is just the first step! The editor supports all the features you expect from a code editor, and we're working on making it even more powerful.
The Internet of Fun
Yesterday, I accidentally built a chat app. Surprisingly, it wasn't the first time it happened.
We've Been Pwned
As long as I can remember Replit has been receiving a large number of vulnerability reports. We're very grateful for these and take them extremely seriously. However, 99% of them stem from a misunderstanding of what we do. Our main product is RCE (remote code execution) and naturally this leads to a whole lot of RCE vulnerability reports.
Don't Let Your Development Environment Rot
Most systems -- both natural and artificial -- decay, rot, and eventually die. Software is no different. A lot has been written about fighting "software rot" but there's another type of rot related to software that's not talked about much -- the development environment rot.
Building Towards a Holistic Development Service
Software development is one of the first -- if not the first -- examples of what J. C. Licklider called the Man-Computer Symbiosis. A "cooperative interaction" between people and computers where the person is concerned in what may be classified as the creative aspect of the work such as setting the goals, formulating the hypothesis and evaluating the results while the computer does all the "routinizable work".
Learning Devops & AWS on the Job: Building and Scaling a Service
Learning Devops & AWS on the Job: Building and Scaling a Service
API Docs
[Update Oct 2022: We have retired our API, we are excited by our previous work but we do not have the resources to support this at the moment.]