# Replit — We've Been Pwned

- Company: Replit (replit.com)
- Announced: 2020-12-03T05:00:00+00:00
- Category: safety-policy-update
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://replit.com/blog/pwnd
- Record: https://forck.live/items/18205-we-ve-been-pwned
- Subject: Replit Agent

Replit disclosed a vulnerability in its developer API that could give full access to another user's repl. The bug was reported by a community member and has been fixed. Replit found no evidence of unauthorized access and revoked all developer tokens.

## Evidence

Verbatim from https://replit.com/blog/pwnd:

> This was ultimately due to an oversight in the token minting code used by our developer API. It used a long since deprecated method of generating tokens when accessing repls owned by someone else. Instead of producing a temporary transparent fork you'd get full access to the underlying repl.

---

Record: https://forck.live/items/18205-we-ve-been-pwned
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md