cat engineering.log

Engineering Blog

Technical insights from the people building Replit.

/
202319 entries
Cover artwork for the article “Replit Deployments: 3x Faster and Even More Features”.

Replit Deployments: 3x Faster and Even More Features

In April, we released Replit Deployments, the fastest way to go from software idea to production. We rebuilt our application hosting infrastructure for production-grade applications thanks to your feedback. In this post, we’ll highlight upgrades, bug fixes, and improvements to Deployments since initial release in April.

April 2 Potential GitHub Credentials Exposure

Yesterday, on April 2, 2023, Replit discovered a site vulnerability that may have exposed GitHub auth tokens for <0.01% of Replit users, stemming from use of the GitHub import feature. This could have permitted unauthorized read/write access to all the repositories of those users by default (users can choose to authorize just a subset of repositories).

Cover artwork for the article “Announcing Outbound Data Transfer Limits”.

Announcing Outbound Data Transfer Limits

Beginning April 7th, Replit will begin enforcing limits on the amount of outbound data that developers can transmit from their Repls to users and external services. Inbound data transfer is free.

Cover artwork for the article “Making Repl Identity More Accessible”.

Making Repl Identity More Accessible

In August last year, we announced Repl Identity, a signed identity for every Repl that your code can use to authenticate other Repls when communicating with your APIs and services.

20226 entries
World map with a network route between two locations and a 253 millisecond latency label.

Worldwide Repls, part 2: Load balancing for fun (although not quite profit)

In our previous blog post about Worldwide Repls, we talked about how we revamped part of our infrastructure to build a new abstraction that allowed us to build other components on top of it: the control plane. In this entry, we'll talk about the very first thing we built on top: a load balancer.

Cover artwork for the article “Zero-Click Auth For Your Apps”.

Zero-Click Auth For Your Apps

Picture this: you've built an arcade game on Replit. Gamers playing your game will head to the repl's cover page and click "Run". They love your game, and they send you feature requests and ideas in the comments. Now, you want to keep track of high scores and add other social features to your game. This used to be a show-stopper: there was no way to verify the API requests coming in, so your high-score feature was either easy to spoof, or simply didn't get off the ground.