replit-known-pitfalls

@jeremylongshore/replit-known-pitfalls

jeremylongshore

1,004

123 forks

Updated 1/18/2026

View on GitHub

Identify and avoid Replit anti-patterns and common integration mistakes. Use when reviewing Replit code for issues, onboarding new developers, or auditing existing Replit integrations for best practices violations. Trigger with phrases like "replit mistakes", "replit anti-patterns", "replit pitfalls", "replit what not to do", "replit code review".

Installation

$skills install @jeremylongshore/replit-known-pitfalls

Claude Code

Cursor

Copilot

Codex

Antigravity

Details

Repositoryjeremylongshore/claude-code-plugins-plus-skills

Pathplugins/saas-packs/replit-pack/skills/replit-known-pitfalls/SKILL.md

Branchmain

Scoped Name@jeremylongshore/replit-known-pitfalls

Usage

After installing, this skill will be available to your AI coding assistant.

Verify installation:

skills list

Skill Instructions

name: replit-known-pitfalls description: | Identify and avoid Replit anti-patterns and common integration mistakes. Use when reviewing Replit code for issues, onboarding new developers, or auditing existing Replit integrations for best practices violations. Trigger with phrases like "replit mistakes", "replit anti-patterns", "replit pitfalls", "replit what not to do", "replit code review". allowed-tools: Read, Grep version: 1.0.0 license: MIT author: Jeremy Longshore jeremy@intentsolutions.io

Replit Known Pitfalls

Overview

Common mistakes and anti-patterns when integrating with Replit.

Prerequisites

Access to Replit codebase for review
Understanding of async/await patterns
Knowledge of security best practices
Familiarity with rate limiting concepts

Pitfall #1: Synchronous API Calls in Request Path

❌ Anti-Pattern

// User waits for Replit API call
app.post('/checkout', async (req, res) => {
  const payment = await replitClient.processPayment(req.body);  // 2-5s latency
  const notification = await replitClient.sendEmail(payment);   // Another 1-2s
  res.json({ success: true });  // User waited 3-7s
});

✅ Better Approach

// Return immediately, process async
app.post('/checkout', async (req, res) => {
  const jobId = await queue.enqueue('process-checkout', req.body);
  res.json({ jobId, status: 'processing' });  // 50ms response
});

// Background job
async function processCheckout(data) {
  const payment = await replitClient.processPayment(data);
  await replitClient.sendEmail(payment);
}

Pitfall #2: Not Handling Rate Limits

❌ Anti-Pattern

// Blast requests, crash on 429
for (const item of items) {
  await replitClient.process(item);  // Will hit rate limit
}

✅ Better Approach

import pLimit from 'p-limit';

const limit = pLimit(5);  // Max 5 concurrent
const rateLimiter = new RateLimiter({ tokensPerSecond: 10 });

for (const item of items) {
  await rateLimiter.acquire();
  await limit(() => replitClient.process(item));
}

Pitfall #3: Leaking API Keys

❌ Anti-Pattern

// In frontend code (visible to users!)
const client = new ReplitClient({
  apiKey: 'sk_live_ACTUAL_KEY_HERE',  // Anyone can see this
});

// In git history
git commit -m "add API key"  // Exposed forever

✅ Better Approach

// Backend only, environment variable
const client = new ReplitClient({
  apiKey: process.env.REPLIT_API_KEY,
});

// Use .gitignore
.env
.env.local
.env.*.local

Pitfall #4: Ignoring Idempotency

❌ Anti-Pattern

// Network error on response = duplicate charge!
try {
  await replitClient.charge(order);
} catch (error) {
  if (error.code === 'NETWORK_ERROR') {
    await replitClient.charge(order);  // Charged twice!
  }
}

✅ Better Approach

const idempotencyKey = `order-${order.id}-${Date.now()}`;

await replitClient.charge(order, {
  idempotencyKey,  // Safe to retry
});

Pitfall #5: Not Validating Webhooks

❌ Anti-Pattern

// Trust any incoming request
app.post('/webhook', (req, res) => {
  processWebhook(req.body);  // Attacker can send fake events
  res.sendStatus(200);
});

✅ Better Approach

app.post('/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const signature = req.headers['x-replit-signature'];
    if (!verifyReplitSignature(req.body, signature)) {
      return res.sendStatus(401);
    }
    processWebhook(JSON.parse(req.body));
    res.sendStatus(200);
  }
);

Pitfall #6: Missing Error Handling

❌ Anti-Pattern

// Crashes on any error
const result = await replitClient.get(id);
console.log(result.data.nested.value);  // TypeError if missing

✅ Better Approach

try {
  const result = await replitClient.get(id);
  console.log(result?.data?.nested?.value ?? 'default');
} catch (error) {
  if (error instanceof ReplitNotFoundError) {
    return null;
  }
  if (error instanceof ReplitRateLimitError) {
    await sleep(error.retryAfter);
    return this.get(id);  // Retry
  }
  throw error;  // Rethrow unknown errors
}

Pitfall #7: Hardcoding Configuration

❌ Anti-Pattern

const client = new ReplitClient({
  timeout: 5000,  // Too short for some operations
  baseUrl: 'https://api.replit.com',  // Can't change for staging
});

✅ Better Approach

const client = new ReplitClient({
  timeout: parseInt(process.env.REPLIT_TIMEOUT || '30000'),
  baseUrl: process.env.REPLIT_BASE_URL || 'https://api.replit.com',
});

Pitfall #8: Not Implementing Circuit Breaker

❌ Anti-Pattern

// When Replit is down, every request hangs
for (const user of users) {
  await replitClient.sync(user);  // All timeout sequentially
}

✅ Better Approach

import CircuitBreaker from 'opossum';

const breaker = new CircuitBreaker(replitClient.sync, {
  timeout: 10000,
  errorThresholdPercentage: 50,
  resetTimeout: 30000,
});

// Fails fast when circuit is open
for (const user of users) {
  await breaker.fire(user).catch(handleFailure);
}

Pitfall #9: Logging Sensitive Data

❌ Anti-Pattern

console.log('Request:', JSON.stringify(request));  // Logs API key, PII
console.log('User:', user);  // Logs email, phone

✅ Better Approach

const redacted = {
  ...request,
  apiKey: '[REDACTED]',
  user: { id: user.id },  // Only non-sensitive fields
};
console.log('Request:', JSON.stringify(redacted));

Pitfall #10: No Graceful Degradation

❌ Anti-Pattern

// Entire feature broken if Replit is down
const recommendations = await replitClient.getRecommendations(userId);
return renderPage({ recommendations });  // Page crashes

✅ Better Approach

let recommendations;
try {
  recommendations = await replitClient.getRecommendations(userId);
} catch (error) {
  recommendations = await getFallbackRecommendations(userId);
  reportDegradedService('replit', error);
}
return renderPage({ recommendations, degraded: !recommendations });

Instructions

Step 1: Review for Anti-Patterns

Scan codebase for each pitfall pattern.

Step 2: Prioritize Fixes

Address security issues first, then performance.

Step 3: Implement Better Approach

Replace anti-patterns with recommended patterns.

Step 4: Add Prevention

Set up linting and CI checks to prevent recurrence.

Output

Anti-patterns identified
Fixes prioritized and implemented
Prevention measures in place
Code quality improved

Error Handling

Issue	Cause	Solution
Too many findings	Legacy codebase	Prioritize security first
Pattern not detected	Complex code	Manual review
False positive	Similar code	Whitelist exceptions
Fix breaks tests	Behavior change	Update tests

Examples

Quick Pitfall Scan

# Check for common pitfalls
grep -r "sk_live_" --include="*.ts" src/        # Key leakage
grep -r "console.log" --include="*.ts" src/     # Potential PII logging

Resources

Quick Reference Card

Pitfall	Detection	Prevention
Sync in request	High latency	Use queues
Rate limit ignore	429 errors	Implement backoff
Key leakage	Git history scan	Env vars, .gitignore
No idempotency	Duplicate records	Idempotency keys
Unverified webhooks	Security audit	Signature verification
Missing error handling	Crashes	Try-catch, types
Hardcoded config	Code review	Environment variables
No circuit breaker	Cascading failures	opossum, resilience4j
Logging PII	Log audit	Redaction middleware
No degradation	Total outages	Fallback systems

More by jeremylongshore

View all

rabbitmq-queue-setup

1,004

Rabbitmq Queue Setup - Auto-activating skill for Backend Development. Triggers on: rabbitmq queue setup, rabbitmq queue setup Part of the Backend Development skill category.

model-evaluation-suite

1,004

evaluating-machine-learning-models: This skill allows Claude to evaluate machine learning models using a comprehensive suite of metrics. It should be used when the user requests model performance analysis, validation, or testing. Claude can use this skill to assess model accuracy, precision, recall, F1-score, and other relevant metrics. Trigger this skill when the user mentions "evaluate model", "model performance", "testing metrics", "validation results", or requests a comprehensive "model evaluation".

neural-network-builder

1,004

building-neural-networks: This skill allows Claude to construct and configure neural network architectures using the neural-network-builder plugin. It should be used when the user requests the creation of a new neural network, modification of an existing one, or assistance with defining the layers, parameters, and training process. The skill is triggered by requests involving terms like "build a neural network," "define network architecture," "configure layers," or specific mentions of neural network types (e.g., "CNN," "RNN," "transformer").

oauth-callback-handler

1,004

Oauth Callback Handler - Auto-activating skill for API Integration. Triggers on: oauth callback handler, oauth callback handler Part of the API Integration skill category.