Choose a prototype's audience boundary by identifying who needs access and what an unintended visitor could see or change. Do not make a prototype public simply because sharing a link is convenient.
Understand the documented choices
Replit's publishing overview lists public, password-protected, workspace-only and invite-only access choices. Publishing also brings together app address, production database, monitoring, security and hosting settings.
The supplied evidence establishes those choice names, not their detailed enforcement, identity handling or suitability for a particular sensitive workload. Review those details before relying on an access boundary.
The following audience-sensitivity matrix is editorial advice expressed as decision prompts, not a statement of product guarantees.
Build an audience-sensitivity matrix
Place your prototype into one of these four situations:
- Broad audience, low sensitivity: A public demonstration using synthetic content may be a candidate for public access review.
- Known audience, low sensitivity: Compare password-protected and invite-only choices against how precisely you need to identify participants.
- Internal audience, higher sensitivity: Review whether workspace-only matches the actual participant group, then separately review information handling.
- External audience, higher sensitivity: Stop and reduce the information exposed before deciding whether any available boundary is appropriate.
For every situation, record whether visitors can only read or can also submit and alter information. Audience size alone does not capture the consequence of access.
Apply it to a hypothetical workshop
Suppose a Bengaluru coding workshop has 12 fictional evaluators: eight organisers and four external mentors. The prototype displays synthetic course schedules and allows schedule edits.
Record three requirements: only those 12 people should participate, outsiders should not edit, and the review should end after two days. A workspace-only choice needs investigation because the participant list includes external mentors. A shared password also needs investigation because the requirement concerns a named group rather than merely possession of a secret.
Evaluate the eventual setup with authorised test participants representing intended and unintended visitors. Check the required read and edit boundaries without sharing account secrets. This is a hypothetical acceptance exercise, not a claim about how any access mode behaves.
Stop when the audience cannot be named
Stop if the team cannot say who should enter or what they may change. Next, remove sensitive material, narrow the participant list and define how access will be reviewed when the exercise ends.
If comparing offers in the coding catalog, check the access format and save terms before buying. Marketplace account, code or token offers are not proof of official subscription equivalence. Purchasing access does not settle your prototype's audience design.
Sources and scope
Source material checked 29 October 2026; features and policies may change. Replit publishing overview establishes the listed access choices and publishing areas. The matrix and workshop scenario are editorial advice. Privacy questions require review; they are not legal conclusions or guarantees about access enforcement.