Windsurf
Is Windsurf secure?
Windsurf is not a security product, and it is not automatically unsafe. Windsurf's agent edits a project you deploy yourself. The public check is of that deployment. Secrets the agent wrote into client code show up if the browser downloads them.
The scan does not read the Windsurf session or your local files.
A useful check is the deployed URL
Paste a URL you own. The scan is passive. It does not log in, brute-force paths, or query a database. Supabase Row Level Security and Firebase security rules are not read. Those stay marked as coming soon.
- Windsurf: Exposed API keys
- Windsurf: Supabase RLS
- Windsurf: Firebase security rules
- Windsurf: Missing security headers
- Windsurf: Open CORS
- Windsurf: Exposed .env files
- Windsurf: Auth misconfiguration
- Windsurf: Cookie flags
- Windsurf: Clickjacking protection
- Windsurf: Exposed git metadata
- Windsurf: Missing robots.txt
Is Windsurf secure?
Windsurf is a way to build an app. The security question is about the URL you publish. Windsurf's agent edits a project you deploy yourself. The public check is of that deployment. Secrets the agent wrote into client code show up if the browser downloads them.
What does a free scan cover?
The public page, up to 10 same-origin scripts, headers, cookies, robots.txt, sitemap.xml, homepage links, and five paths: /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
What will a scan of a Windsurf URL miss?
The scan does not read the Windsurf session or your local files.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.