From Replit prototype to published app: what the platform covers and what your team keeps

What an Agent prototype proves, and what it does not

Replit's first-app guide describes a simple loop: describe one outcome, add observable success criteria, set boundaries, let Agent build, test in Preview, then ask for one focused improvement. The example is a small workshop-discovery website built in Free Mode, and it takes about ten minutes by the guide's own estimate.

That loop proves that your idea can be turned into something people can click through. It shows the main journey, the layout on a phone-sized screen and whether the prompt captured what you meant. It does not prove that the app can protect accounts, keep records or survive real traffic. The guide is explicit here: it postpones login, data, payments and integrations so the first build stays focused.

Treat the prototype as a shared specification. A business owner can use it to agree what the app should do before anyone invests in the harder parts.

Sources: Your first app (docs.replit.com)

Step two: login and a database that keeps records

Replit's database guide starts from a common problem: cars and reservations in its example vanish on refresh because they live only in the browser. The documented fix is to ask Agent to save the data to Neon, which Replit describes as its managed Postgres database. According to the guide, Agent provisions it with separate Development and Production environments. For a throwaway prototype, the guide points to Replit Database as a zero-setup alternative.

The useful part is the test routine. The guide asks you to make a reservation, refresh, restart the app, try a conflicting booking from a second account, and sign out and back in. Each check targets a different failure: lost data, lost state after restart, a missing business rule, and weak session handling.

Your team supplies the rules. The guide's prompt states that each booking belongs to the signed-in customer and that the same car cannot be booked on overlapping dates. Replit's responsibility page says users are the ones who state the desired business logic, so Agent can write that logic only if someone has defined it.

Sources: Add database (docs.replit.com) · Shared responsibility model (docs.replit.com)

Step three: publishing is a separate release

Replit's publishing guide says the preview URL is private by default, temporary and meant for development. Publishing creates a production deployment at its own URL. Because the two are separate, you can keep editing without changing the live app until you publish again.

Before publishing you choose who can open the app: public, password protected, workspace only or invite only. You can also run a deep security scan and set publishing to block critical vulnerabilities. The guide advises keeping secrets and private test data out of the app, and opening the public URL afterwards to test the live version rather than the preview.

The database guide adds one specific check: make a reservation on the public URL, refresh, and confirm it remains. If data saves in Preview but not live, the guide suggests asking Agent to confirm that the Production credentials are wired into the deployment.

Sources: Publish your app (docs.replit.com) · Add database (docs.replit.com)

What Replit runs and what your team owns

Replit's shared-responsibility page splits the work. Replit is responsible for Agent code generation, the platform, edge protection, encryption in transit and at rest, and backups of published-app code and Replit-managed database contents. It also maintains its own platform attestations, with SOC 2 Type II given as an example. That is an audit attestation about the platform, not a guarantee about your app.

Your team owns the rest: reviewing Agent output for correctness, security and licensing; stating the business logic; managing users and access; choosing the right visibility; handling data and privacy notices; meeting the laws that apply to your app; penetration testing; and application-level logging. You also approve sensitive actions Agent proposes, such as deploys, secret changes and outbound calls, and the page asks you to treat that as a real review.

The same page warns against pasting keys into prompts and says to use the Secrets feature and Connectors instead. Replit also detects vulnerable dependencies in published apps, but fixing them is yours.

Sources: Shared responsibility model (docs.replit.com)

Costs: subscription, deployment resources and your time

The Replit pages we read do not state plan prices, credit limits or how Agent usage is billed, so those remain questions for Replit. What they do show is where cost comes from. The publishing guide describes deployment types (Autoscale, Reserved VM, Static and Scheduled), machine power, the maximum machine count and the region, and notes that more resources can raise usage costs. It also says these controls are optional for a typical app.

The third cost is operations. Every change must be tested in Preview and then republished, which creates a new release at the same URL. Monitoring shows requests, status codes, response times, CPU and memory. The region choice is permanent once published, so decide it deliberately.

Plan also matters for terms. The responsibility page ties some obligations to the agreement for your plan (Terms of Service for Free and Core, a Pro Agreement, or an Enterprise Agreement) and says Pro customers can choose a workspace location at creation. Check which plan includes the controls you need.

Sources: Publish your app (docs.replit.com) · Shared responsibility model (docs.replit.com)

Splitting roles and questions to ask before committing

This is an editorial suggestion, not a Replit feature. A business owner writes the success criteria and rules, then tests the journey in Preview. An operations contact checks access settings, data and live behaviour after each release. A technical reviewer reads the generated code around authentication and data, and handles vulnerability alerts. Small teams can combine roles, but someone must hold each one.

Ask Replit about the plan price, what Agent usage costs, what deployment resources typically cost for your traffic, which plan offers the access and region controls you need, and how data is handled for your plan. The responsibility page says prompt logging, retention and training use follow the terms of your plan.

Sources: Shared responsibility model (docs.replit.com) · Your first app (docs.replit.com) · Publish your app (docs.replit.com)