From the source
From the source
Replit discloses a critical vulnerability in its developer API.
Replit disclosed a vulnerability in its developer API that could give full access to another user's repl.
The bug was reported by a community member and has been fixed.
Replit found no evidence of unauthorized access and revoked all developer tokens.
From the source
This was ultimately due to an oversight in the token minting code used by our developer API. It used a long since deprecated method of generating tokens when accessing repls owned by someone else. Instead of producing a temporary transparent fork you'd get full access to the underlying repl.
