What it does
Automatic vulnerability scanning of dependencies used in the user's apps. CVE tracking. SBOM report generation.
Evidence
- Replit - Workspace Settings — dedicated Security subpage.
- Feature list (all checkmarked): 1. Scan workspace Apps for security vulnerabilities 2. View detailed CVE information and severity levels 3. Track security scan history across your workspace 4. Download Software Bill of Materials (SBOM) reports
Why this is strategically important
💭
SBOM reports are a B2B procurement requirement. Enterprise buyers running vendor assessments need them. Security-conscious verticals (finance, healthcare, government) require them. That Replit sells SBOM inside Core means:
- Core is positioned as a B2B-ready SKU, not just a "power-user" upgrade.
- Replit is seriously targeting organizations that have procurement processes — i.e., the upper end of Enterprise Developers segment.
- This is a concrete moat vs. Anything.com, which has no equivalent surface. Anything.com literally cannot answer "are the dependencies in my app scanned?" with a yes.
Technical implementation signals
- CVE feed consumption → likely NVD (National Vulnerability Database).
- Severity levels → CVSS scoring.
- SBOM → likely CycloneDX or SPDX format.
- "Scan history" → audit-log architecture.
Gating
Core-only. Free tier has no security scanning.
Differentiators vs Anything.com
- No equivalent feature in Anything.com in current sources. No security messaging, no CVE dashboards, no SBOM output.
Sources
- !raw/replit/Settings.png