Inside Replit’s New Sandbox Engine, Part 1: The Path to MicroVMs
How Replit rebuilt its sandbox engine with microVMs for stronger isolation, bottomless storage, and fast startup across hundreds of millions of projects.
Articles
92 articles
Security advisory: Make managed cloud environments the default for AI agents
Why autonomous AI agents need dedicated, organization-controlled environments with independently enforced security boundaries.
Agent Habitat Architecture
A proposed security architecture and maturity scale for agent habitats, covering identity, execution, permissions, data flows, approvals, and recovery.
ViBench 2.0: A Benchmark for Long-Horizon Software Building
ViBench 2.0 tests whether AI agents can build a whole product one feature at a time. It joins the Specialized Intelligence Index from Fireworks.
Free the models: Harness design at the frontier
Model routers are everywhere right now, but they have a fundamental limitation. No matter if based on advanced heuristics or a small model that reads each turn and picks which LLM to use, a router will always be less capable than the model it’s choosing for. Replit Agent lets the model decide instead.
AI adoption starts with truth
Giving agents access to company data is only the start. Why trustworthy answers also need shared definitions, clear ownership, and evidence people can check.
Closing the loop: Evaluating and improving Replit Agent at scale
A benchmark score can’t tell the whole story. How we combine app testing, A/B experiments, and failure analysis to make Replit Agent better.
We Built a Video Rendering Engine by Lying to the Browser About What Time It Is
How Replit turns any web page into a deterministic video by virtualizing time itself, patching key browser audio APIs, and waging war against headless Chrome's quirks.
Decision-Time Guidance: Keeping Replit Agent Reliable
Replit Agent stays reliable through decision-time guidance—injecting situational instructions at key moments rather than front-loading all rules.
![Cover artwork for the article “How Replit Secures AI-Generated Code [white paper]”.](https://cdn.replit.com/engineering-blog/v1/images/795091fa15707937848fcd8cb13ac016459b4911543e3457d14280dee377c800.webp)
How Replit Secures AI-Generated Code
AI security scans alone aren't enough. New research shows hybrid approaches combining static analysis with LLM reasoning are essential for vibe coding.
Inside Replit’s Snapshot Engine: The Tech Making AI Agents Safe
An agent needs room to experiment and a way back when it gets things wrong. Inside the filesystem snapshots and database forks that make that possible.
Enabling Agent 3 to Self-Test at Scale with REPL-Based Verification
An app can look finished and still fail when you click it. How Agent 3 combines code execution and browser testing to check its own work.
Building Production-ready Apps with Automated Database Migrations on Replit
Learn how Replit automated database migrations between dev and production environments, enabling safe AI agent development with minimal user intervention.
Using Tvix Store to Reduce Nix Storage Costs by 90%
Our Nix package disk had grown to 20 TB. How Tvix Store cut storage costs by 90% without dropping the packages older projects depend on.
Introducing Workflows
Stop retyping the same shell commands. Turn your development routine into reusable tasks, then run them together with Replit Workflows.
Replit's All-new Database Editor
See and edit your app’s Postgres data in a familiar table view. A look at Replit’s database editor, with no SQL required to get started.
So you suspect you have a memory leak...
Garbage collection doesn’t prevent every memory leak. How to confirm a leak, inspect a running program’s heap, and track down what won’t let go.
Shell2: 200× faster, persisted, multiplayer-native Shells
A shell that keeps its history and works with other people. How we rebuilt Replit’s terminal for speed, persistence, and multiplayer sessions.
How Replit makes sense of code at scale
What are people building with Replit? How we analyze anonymized public code and organize it into a taxonomy, without reviewing private projects.
Improved Dependency Management
Languages, packages, and system libraries now share one place in the workspace. How the Dependencies pane helps you configure projects with more than one language.
Advanced port configuration
Run multiple services without guessing which port goes where. Explicit mappings, localhost previews, and a Networking tool make the connections easier to follow.
Searching Nixpkgs in Under 30 Milliseconds
Finding a Nix package shouldn’t keep you waiting. How rippkgs indexes Nix expressions and returns search results in under 30 milliseconds.
Replit + pip
Prefer requirements.txt to Poetry? Replit now supports pip directly, with a short migration path for existing Python projects.
Easier Editing for .replit Files
Configure your project without hunting through docs. Code completion and inline help bring the .replit file’s options into the editor.
Landscape or Portrait? You Decide
Code upright on your phone or turn your tablet sideways for more room. Here’s how we made Replit adapt to both.
Dec 12 Incident Update: Secrets and repl.co Static Hosting Unavailable
How a storage configuration change disrupted Secrets and legacy static hosting in December 2023, and what we changed after the recovery.
GitHub x Replit Workflows: Enhancing Developer Productivity
Find the right repository, bring it into Replit, and get to work. What changed in GitHub imports, authentication, and the Git pane.
Skip the README, let us install for you
Python packages often need libraries that pip can’t provide. Replit detects those missing system dependencies and installs them for hundreds of packages.
New and Improved Console
Past runs shouldn’t vanish when you need them. A tour of the rebuilt Console, its saved execution history, and the choices behind the interface.
System Dependencies on Replit
Search for native tools and libraries without writing Nix configuration by hand. A guide to adding and managing system dependencies in the workspace.
Tabs and Spaces - Smarter Indentation
Keep pasted code aligned and let the editor pick up a file’s indentation style. Small changes that take the fuss out of tabs and spaces.
Sep 29 Incident Update: Read-Only Repls
An incomplete storage build left some projects read-only on September 29, 2023. Our account of the incident, recovery work, and safeguards that followed.
Changes to Hosting on Replit
Why we’re moving legacy hosting to Deployments, what that means for existing apps, and why the free development experience isn’t going away.
Upgrading Analytics for Deployments
See how people use your deployed app without leaving the workspace. A tour of the analytics tab and the traffic data it puts at hand.
Packages: Powered Up
Install packages with fewer clicks, see what’s already in your project, and get clearer errors when something goes wrong.
Performance Mystery: Is Golang's Startup Time Slow?
A package manager spent 200 milliseconds doing almost nothing. Following that delay led us through a surprisingly tangled Go performance bug.
Improving the Inline Ghostwriter Experience
AI suggestions are easier to judge when they stay beside your code. Persistent widgets, streamed responses, and diff views improve Ghostwriter’s inline tools.
Expand possibilities on Replit with Expandable Storage
Larger datasets and dependencies need more room. How expandable storage removes the old per-project ceiling, and how to manage the extra space.
Why We Changed Our Resource Limits and Plans
More powerful projects brought higher infrastructure costs. Why we changed resource limits and plans, and how user feedback shaped the response.
Fewer Restarts and Faster Networking for All
Fewer interrupted sessions, including on the free plan. How storage and networking changes helped us make Replit more stable and quicker to connect.
Rebuilding the Replit Filetree for Superior Performance and Accessibility
An 8,000-file codebase exposed the limits of our filetree. Virtualization, local caching, and keyboard navigation made large projects easier to work with.
Replit Deployments: 3x Faster and Even More Features
Faster deploys, fewer failures, and less friction getting an app online. What changed in Replit Deployments after its first release.
Replit Storage: The Next Generation
Getting past the 1 GiB storage limit meant rethinking the filesystem underneath it. Inside the snapshot and copy-on-write design that made larger projects possible.
The Journey To Code Search
Find a function, narrow a query, or replace matches across a project. The engineering story behind Replit’s code search and regex support.
June 6, 2023, Single-Sign-On Security Vulnerability
What we found in a June 2023 single-sign-on audit, how we patched the vulnerability, and how we notified potentially affected users.
Configurable Keybindings for the Workspace
Make the workspace shortcuts your own. How we built configurable keybindings that handle chords, different devices, and competing keyboard conventions.
Super Colliding Nix Stores: Nix Flakes for Millions of Developers
Combining Nix stores makes development environments more portable. How a layered store can bring Nix Flakes to millions of Replit users.
Making Git Good
Git mistakes shouldn’t require an afternoon to undo. The design and engineering behind a Git pane built for both beginners and experienced developers.
How to train your own Large Language Models
From raw code to a model serving users: the data pipelines, training infrastructure, and evaluation work behind Replit’s language models.
Hackers, Pros, and Teams users can now code for hours without restarts
Switching away from preemptible VMs cut workspace restarts tenfold for paid plans. The infrastructure tradeoff behind longer, uninterrupted coding sessions.
April 2 Potential GitHub Credentials Exposure
Our account of the April 2023 GitHub token vulnerability: who may have been affected, how we fixed it, and what users should check.
Announcing Outbound Data Transfer Limits
Why Replit introduced outbound data limits, how to track usage, and which changes can help keep an app’s bandwidth needs down.
Worldwide Repls, part 3: Firing Up The Engines
You can’t optimize away the speed of light. How we reworked clusters and moved users’ compute closer to them without making them start over.
Remote Access to Your Repls via SSH
Use your own terminal or editor with a project running on Replit. How to connect over SSH, and how remote access works behind the scenes.
Replit x Weights & Biases Machine Learning Hackathon Winners
Seven days to build with machine learning. Meet the winning projects from Replit’s first hackathon with Weights & Biases.
Apply for Replit’s first Machine Learning Hackathon
The plans for our first machine learning hackathon with Weights & Biases, including project resources, participation details, and prizes.
Making Repl Identity More Accessible
Create and verify signed project identities from the command line. Repl Identity becomes available to any language that can run a subprocess.
Redesigning Cycles Transaction History
A transaction list should tell you where your money went. How we redesigned Cycles history to make purchases, tips, and bounties easier to follow.
Branching out the Filetree
Move files in batches, find them faster, and spend less time waiting. A tour of the filetree’s new controls and performance improvements.
Worldwide Repls, part 2: Load balancing for fun (although not quite profit)
An off-the-shelf load balancer couldn’t route containers the way we needed. How we built an alternative and brought it into production.
History++ - A Better Way to Do Versioning
Every edit leaves a trail. How Replit turns its multiplayer editing log into file history you can browse without making a commit.
Zero-Click Auth For Your Apps
Is that high-score submission really from your game? Repl Identity gives programs a signed identity so your API can check who’s calling.
Get Replit Famous
Good projects shouldn’t disappear in a busy feed. How we built a community feed to help people follow friends and discover new work.
Revamping the GitHub Import Flow
GitHub imports were stuck on an older setup while the rest of Replit moved to Nix. Fixing that made imports faster and simpler.
Inspect your HTML/CSS/JS Repls with native DevTools
Inspect a page and debug JavaScript without leaving Replit, even on mobile. The permissions, security, and timing challenges behind our built-in DevTools.
Leaky UIs
Dragging and resizing panes sounds simple until the data structure gets in the way. What our workspace layout taught us about UI abstractions.
Worldwide Repls, part 1: The Control Plane
Moving compute closer to users started with separating the control and data planes. Inside the infrastructure refactor that made global routing possible.
Improving Domain Linking for Repls
Connect root domains, link multiple addresses, and troubleshoot DNS more easily. A closer look at the changes to custom domains on Replit.
QLTY SZN 1
Moving fast left some rough edges in the editor. Here’s where we’re focusing on fixes, performance, and the feedback that shapes both.
Escaping Dirty Pipe (a.k.a. CVE-2022-0847), mostly unscathed
How the Dirty Pipe Linux vulnerability affected Replit, what we did to address it, and why we found no evidence of successful exploitation.
Betting on CodeMirror
Why we moved from Monaco to CodeMirror 6, what the new architecture makes possible, and what it took to switch editors.
All New Repls are Powered By Nix
One package system for every new project: how moving to Nix brought faster Python startups, newer runtimes, and more control over your environment.
Announcing File Persistence in Hosted Apps… for Everyone!
What it took to bring persistent files in hosted apps to everyone: a gradual rollout, better monitoring, and a few infrastructure optimizations.
Making new Python repls 100x faster to start up
Reinstalling packages at every startup made Python projects painfully slow. How a new template cut that wait and made room for larger dependencies.
Understanding Repl Resource Utilization
What do the CPU, memory, and storage meters actually tell you? A guide to reading resource usage and understanding why a project slows down.
Going Where the Next Billion Creators Are
Rebuilding the mobile web IDE meant changing how it worked, not just how it looked. Why that matters for people who code on phones.
Migrating our Web App from Heroku to GCP
Moving a live website means more than moving servers. How we brought Replit’s databases, caches, and frontend from Heroku to Google Cloud.
Implementing RUI, Replit's Design System
Seven avatar components were a sign we needed a design system. The CSS tradeoffs and API decisions behind building RUI.
Repl Space and Templates
Add your own tools, configure how code runs, and share the setup as a template. A look at making Replit more customizable.
Ace, CodeMirror, and Monaco: A Comparison of the Code Editors You Use in the Browser
We compare and contrast the top code editors that you use in your browser.
Will Nix Overtake Docker?
Nix and Docker both tackle the works-on-my-machine problem, but in different ways. A practical comparison of their approaches to reproducible environments.
How to Set Up Your Own Mastodon Instance with Replit
Build your own corner of the social web with Mastodon. This walkthrough covers the databases, server configuration, and installation on Replit.
Announcing File Persistence in Hosted Apps for Hackers
Hosted apps need to save files even when the editor is closed. How file persistence opened up uploads, SQLite databases, and more.
Betting on Nix: donating $25K to the NixOS Foundation
What if running code didn’t mean waiting for packages to install? Why we’re backing Nix, and putting $25,000 behind it.
Solidity on Replit: Diving into Web3
Write and test Ethereum smart contracts in your browser. A tour of Replit’s Solidity template and the engineering behind it.
A New Code Editor for Mobile - CodeMirror 6
Writing code on a touchscreen deserves a better editor. CodeMirror 6 brings a mobile-first editing experience to Replit.
The Internet of Fun
A Python prompt and a page of HTTP logs became unlikely chat rooms. Two stories about people finding ways to make the internet more fun.
We've Been Pwned
A user found a token bug that granted access to someone else’s project. We explain what went wrong and how we responded.
Don't Let Your Development Environment Rot
Slow setup and fragile workflows creep up on a team. Here’s how onboarding, automation, and a closer look at daily work can catch them.
Building Towards a Holistic Development Service
What could developer tools do if editing, running, and deploying code weren’t separate jobs? A case for bringing the whole process together.
Learning Devops & AWS on the Job: Building and Scaling a Service
From manually starting servers to automating deployments: the mistakes and lessons behind scaling Replit’s code execution service on AWS.
API Docs
An archived guide to running code through Replit’s HTTP and WebSocket API, with examples and setup instructions. The API was retired in October 2022.