Summary
On August 7, 2026 Replit added an automatic Semgrep scan to its Agent's code review, checking the files the Agent changes for risky patterns and hardcoded secrets. The scan runs as part of the Agent's own review of its output, catching common security issues before they ship.
What changed
Replit Agent now runs an automatic Semgrep scan over the files it modifies as part of its code review, flagging risky patterns and hardcoded secrets. The same August 7 update also lets pro builders configure enterprise SSO for Replit Apps using Clerk Auth with Agent guidance, and regenerate production database credentials from the Database tool with an automatic redeploy.
Why it matters
As agents generate more shippable code, the risk of introducing vulnerabilities or leaked secrets scales with them. Building a static-analysis gate directly into the agent's self-review shifts security left to the moment code is written, rather than relying on a separate downstream scan, and signals that AI app builders are treating agent-authored security defects as a first-class problem.
Evidence excerpt
Agent now checks the files it changes for common security issues as part of its code review through an automatic Semgrep scan that looks for risky patterns and hardcoded secrets.