Skip to main content
Treat a repository contribution as privileged development work. Agent can inspect and change files in its attached cloud sandbox and run repository commands. Review the access you grant, the data available to the sandbox, and every proposed change before merging.

​
Limit access before work starts

  • Connect only the repositories needed through your personal Git integration. Check its granted permissions and your organization’s review policy.
  • Configure the environment with the minimum shared setup needed. Avoid sensitive data in the prebuilt image, build steps, chat messages, and committed files.
  • Provide secrets through the secure chat flow, with the smallest practical scope. Where supported, use narrowly trusted machine identity and short-lived provider credentials. See Adding Secrets to Environments and Machine Identities.
  • Review repository instructions and third-party dependencies before relying on them. Replit makes AGENTS.md and CLAUDE.md guidance available to Agent; check which instructions apply to the change.

​
Review the result

Ask Agent for the changed files, relevant tests, and any access it needed. Inspect the diff for unexpected edits or credentials, run your normal checks, and use your team’s pull request or merge request approvals. A passing test or an Agent summary does not replace a code review. Keep production deployment and merge permissions with the people and systems your team already uses. Example request: “Before proposing a draft PR, list the files changed, explain why each changed, run the relevant tests, and flag any credential, dependency, or permission changes for review.”

​
Isolation and assurance

Replit’s sandbox runtime is designed around microVMs, lightweight virtual machines that contain the development workload and its supporting processes. The microVM is the isolation boundary; a container inside it is not a separate equivalent boundary. A chat coordinates the work, while the attached sandbox runs repository commands. That is different from treating the conversation itself as a deployed application or moving your app into a Replit Project. Isolation does not remove the permissions you grant to code running inside the sandbox. A process with access to development credentials can use those permissions. Limit credentials and review repository setup commands accordingly. Confirm the current architecture and any compliance claims with your security team before relying on them in an assurance review. This guide does not make guarantees about data residency, network isolation, or certification. See How coding with Replit works for the sandbox lifecycle and Changes and pull requests for the review workflow.