Windsurf app security: command control, secrets and a pre-launch check

Abstract render of a stack of thin glass layers where one repaired layer glows green

By the FixMyVibe team · Last reviewed 16 October 2026

Windsurf's agent can run terminal commands, so choose its auto-execution level deliberately (Turbo runs everything except your deny list) and keep secret files ignored. Then check what it built: no private keys in the repository and database rules that only let each user reach their own data.

Scan my repo free (read-only)See an example report

Two different things to secure

Your environment: the agent can run terminal commands on your machine, in a dedicated terminal (macOS and Linux) that loads your shell configuration, including aliases and environment variables. Your app: once deployed, leaked keys and open database rules are the usual weak spots.

The typical risks

1. Auto-executed commands

The docs list four levels: Disabled (every command needs approval), Allowlist Only, Auto (the agent judges which commands are safe; premium models only) and Turbo (everything runs except deny-listed commands). An allow-list entry ending in * matches every command starting with those tokens, so git * also allows any git subcommand. The deny list always wins over the allow list.

2. Secrets in reach of the agent

Hidden paths and files in .gitignore aren't indexed, and gitignored files can't be edited by the agent. Add other sensitive paths to the repository's ignore file. Because the agent's terminal loads your shell configuration, avoid exporting production secrets in .zshrc/.bashrc.

3. Secrets in the code it writes

A key pasted into a prompt can end up hardcoded and committed. Use environment variables, review diffs, and rotate anything that was exposed; see leaked API keys.

4. Open database rules

If the app uses Supabase from the browser, check RLS on every table: Supabase RLS check.

What the free FixMyVibe scan checks

Paste the URL of a public GitHub repository. The free scan reads the code read-only on a temporary copy that is deleted afterwards, and looks for:

  • Hardcoded secrets in the current files: API keys, tokens, Supabase secret/service_role keys, private keys, and secrets exposed through NEXT_PUBLIC_/VITE_ variables or committed build output.
  • Supabase database rules in your committed SQL migrations: tables without RLS, USING (true)/WITH CHECK (true) policies, policies that trust user_metadata, and similar patterns.

What it does not do: it does not scan your git history (only the current files), it does not connect to your database or your live Windsurf-built app, and it cannot see private repositories. Dependency checks against the OSV vulnerability database are part of the paid audits, not the free scan. It is an automated code scan, not a penetration test.

Pre-launch checklist

  1. Pick an auto-execution level below Turbo unless you trust every command; keep destructive commands (rm, git push) on the deny list.
  2. Keep allow-list entries narrow.
  3. Make sure .env and key files are gitignored or listed in the ignore file.
  4. Don't export production secrets in your shell profile.
  5. Review diffs for hardcoded keys before committing; rotate any key that was exposed.
  6. Check RLS on every Supabase table, then scan the repository.
Scan my repo free (read-only)See an example report

FAQ

What is Turbo mode in Windsurf?

One of four auto-execution levels for the agent's terminal commands: Disabled, Allowlist Only, Auto and Turbo. In Turbo, every command runs immediately except those on your deny list. Teams and Enterprise admins can cap the maximum level.

How do I keep secret files away from the agent?

Files matched by .gitignore aren't indexed and can't be edited by the agent, and you can add more paths in an ignore file at the repository root. The docs now name it .devinignore; the legacy .windsurfignore and .codeiumignore names are still read.

Why does the documentation say Devin Desktop?

Windsurf's documentation (docs.windsurf.com) now presents the editor as Devin Desktop. The settings described on this page are taken from those docs.

Does FixMyVibe check my Windsurf setup?

No. The free scan reads the app code in a public GitHub repository for hardcoded secrets and Supabase RLS problems. It doesn't inspect your editor settings.

Sources

FixMyVibe is an automated code scan, not a full penetration test, and cannot guarantee that an app is secure. What happens to your code during a scan: see our privacy policy.