Security and Replit
More impressive the more you think about it
When Replit first came out, I was perplexed. I really just couldn’t wrap my head around how it worked. Lovable too, but for the rest of the article, I’ll mainly be talking about Replit. Not the AI part, but the rest of it. The software and the organizational structure both had to be cohesive to create a product of that kind so quickly and so early in this AI phase of technology.
My first interaction with them was early 2025 and at that point I hadn’t been using too many AI coding tools aside from VS Code with Github Copilot and some autocomplete. However, I was doing a lot more fullstack work at the time and thought I understood how frontends and backends worked.
General Workflow
For the uninitiated who haven’t worked with one of these tools before, its basically just prompting an LLM to spit out a website. The harness at the time was ahead of its time and its still really cool.
But the REALLY cool part is that right after you prompt, the application immediately spawns within the same tab in your browser and its effectively the full application. The wildest part is both Replit and Lovable have wrote somewhat extensively about how they built their systems, or at least enough that you can do a bit of educated guessing on how it all works.
Isolated Cloud Sandboxes and Floods
The first thing in my mind that made the stack interesting and why it was confusing to me is that they really do just ship a containerized environment that’s completely isolated. 2025-Jerry saw this and was like, no way, that sounds super expensive. The microVM that the container is shipped on is expensive, but more importantly all the time and talent spent on securing the containers looked super expensive.
Even now, several years after they shipped their product, its not quite clear what exactly an LLM can spit out with every prompt and its not quite clear we can build harnesses that handle all LLM silliness; there’s odds of needing to re-prompt or pass through sub-agents or do an amalgamation of post processing to ensure a reasonable output.
In some sense, this wasn’t a new problem Replit faced that other organizations didn’t. After all, CI/CD platforms and code runner platforms are dealing with nearly equivalent security concerns. Effectively all software platform-as-a-service companies that target anyone remotely technical as a customer, has to deal with these issues as impending threats. But the volume, does really ramp up and that has caused a lot of issues. I love pointing it out, but Github is still not dealing with the AI code commits well.
That said, Replit goes a bit in depth on how they do the security for their sandbox in their blog.
The key things, that I didn’t immediately guess, were that they use are Determinate Nix as a package manager, GCP was chosen as infra with Cloud Run as their sand-boxing method, and, perhaps most importantly, EVERY CUSTOMER GETS THEIR OWN GCP PROJECT INCLUDING FREE-TIER USERS. What a wild decision. The decision to do such a thing almost builds in a requirement to use infrastructure as code, and permission management seems like a nightmare to get through. And adding in the idea of autonomous traffic from AI agents, its hard to not see how daunting the system that needs to be created is.
Security Arms Race
As with most software that is powerful and being given out to anyone, the immediate concern I have is “how will I stay ahead of it breaking?” And I don’t mean breaking in the sense of servers error-ing out or frontends having bugs. I mean, what if a person purposefully uses packages that are known supply-chain attacks? How do you stay up to date every day with every bug, to ensure your vulnerability doesn’t endanger the rest of your client base? What happens when someone tries to mine Bitcoin on their Cloud Run instance?
Maybe my concerns are actually just a demonstration that I don’t fundamentally work with consumer software that would glean the eyes of people trying to break into my stuff; generally people want the things to work, or the data isn’t life-threateningly important.
Regardless, I find myself admiring engineers who are willing to make products like this, because every time code is shipped it is done with some amount of bravery and boldness.