My old Replit deployment still has my data. How do I delete it?
Delete the Repl AND invalidate every secret it held. In Replit: three dots on the Repl → Delete. But this doesn't revoke API keys, Supabase service-role keys, or OAuth tokens that were in the env vars — you need to rotate those separately on each service. Old deployment URLs may stay cached on Replit's CDN for hours.
Deletion in Replit doesn't propagate to the services that held your keys. Checklist:
**1. Rotate every secret the Repl had.** In the Repl's Secrets tab (padlock icon), list every key. Rotate each on its native platform (Supabase, Stripe, OpenAI, etc.). Any key still valid is still usable by anyone who snapshotted the Repl while it was live.
**2. Delete the Repl.** Three dots menu → Delete. This removes public access, but Replit keeps data for a while (check their retention policy). Assume the code still exists somewhere for at least 30 days.
**3. Invalidate forked copies.** Replit allows forking public Repls. Anyone who forked yours now has the code + your (rotated) keys. There's nothing you can do about this — the fork is theirs — except ensure the keys no longer work.
**4. Check for cached deploys.** Replit's CDN may serve the old deployment URL for hours. The URL itself isn't the problem; the concern is if it still contains live data. If your app serves user data, make sure: - You rotated the service-role key (so the cached app can't read from Supabase) - You changed the Supabase project URL if possible (hard, usually impractical)
**5. Search for leaked URLs.** Search Google for `site:<your-replit-url>` — your deployment may be indexed and cached externally. File a removal request via Google Search Console if you find cached sensitive data.
Securie's scan (launching this year) will walk your GitHub + known Replit deployment URLs + screenshots for any trace of the old keys. Join the list for a week-1 run — founders often rotate the obvious keys and miss an old one still sitting in a demo Repl from 6 months ago.