How do I secure my Replit app?

Start by storing all sensitive values in Replit Secrets rather than hardcoding them in source files. Implement input validation and output encoding on all user-facing endpoints to prevent XSS and injection attacks. Add rate limiting middleware to protect against brute force and denial-of-service attempts. Set security headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security in your application responses. UNPWNED assesses externally observable header, exposure, endpoint, CORS, form, dependency, rate-limit, and error-disclosure signals. Free reports show completed finding titles and severities; paid reports add full detail and step-by-step remediation guidance. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.