docs.windsurf.com redirects to docs.devin.ai and the product is now documented as Devin Desktop; the windsurf slug is kept for the hub. Cascade is limited to 20 tool calls per prompt per the overview page.
Windsurf, now documented by Cognition as Devin Desktop, is an AI IDE whose Cascade agent edits code, runs commands and can deploy web apps to Netlify at a windsurf.build URL. Command auto-execution has four levels, from approve-everything to Turbo.
The app is what gets tested. The patterns here are the cross-stack set plus the deploy-path pattern, because one-click deploys to a public URL make it easy to skip the step where someone checks what went live.
Each row is taken from the vendor's documentation on the date shown. Defaults change; the date is the claim.
| Area | Default | Source |
|---|---|---|
| Frontend | Devin Desktop (formerly Windsurf) is an AI IDE that imports VS Code or Cursor settings; it does not choose a stack. Repository URLs still use the pre-rebrand windsurf naming. | docs · verified 2026-09-21 |
| Command execution | Cascade offers four auto-execution levels; Disabled requires approval for every command and Turbo auto-executes everything except the deny list. Allow and deny lists are settings, and the deny list takes precedence. The docs do not state which level is default. | docs · verified 2026-09-21 |
| Hosting | App Deploys publishes to Netlify at a public URL of the form <subdomain>.windsurf.build, with a link to claim the project on your own Netlify account; a windsurf_deployment.yaml file is written to the project root. | docs · verified 2026-09-21 |
| Secrets / env vars | Indexing ignores .gitignore paths, node_modules and hidden paths by default, and files in .gitignore cannot be edited by the agent. The App Deploys page does not describe environment variable handling. | docs · verified 2026-09-21 |
| Source access | Auto-generated memories are stored locally in ~/.codeium/windsurf/memories/ and are not committed to the repository. | docs · verified 2026-09-21 |
| Data use for training | On paid plans you can opt out on the Data Controls page; after opting out data is not used for training and Zero Data Retention is enabled with model providers. Enterprise data is never used for training without written consent. | docs · verified 2026-09-21 |
Documentation home: docs.devin.ai/desktop/getting-started
52 patterns in the catalogue name Windsurf; the most severe are listed here across secrets and keys, data access, login and permissions, payments. Attribution is descriptive: the default stack makes the pattern reachable, or a public incident names it.
The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
Anyone with the app's public Firebase config, which sits in its JavaScript, can read, overwrite or delete the entire database and storage bucket without signing in.
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
Signed-out visitors or other customers can read rows meant for one account, while the owner sees an empty page and nobody notices.
Anyone who creates a free account can page through every other customer's records, which is a data breach with a sign-up form as the only step.
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
The table looks protected in the dashboard, yet any visitor with the public anon key can read, insert, update and delete every row.
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
Anyone who calls the API directly, or edits the page in developer tools, gets the data and actions the screen was hiding.
Anyone who reads the code or guesses a common placeholder can sign in as the administrator.
Anyone can write their own token naming another user, or an admin, and the server will act as that person.
A visitor who edits the signup request, or updates their own profile, can make themselves an admin.
Anyone who finds the webhook URL can post a made-up payment-succeeded event and get an order fulfilled or a plan activated for a user of their choosing, without paying.
Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.
Apr 2026 · Lovable · all sources
One education app built on Lovable had 16 vulnerabilities, 6 critical; a database function denied callers whose role was 'authenticated', so anonymous callers passed and 18,697 user records were readable without login.
Feb 2026 · Taimur Khan · all sources
A scan of 1,645 Lovable-built apps found 170 (about 10.3%) with database endpoints readable without login because Supabase row-level security policies were missing or too broad; recorded as CVE-2025-48757, CVSS 9.3.
May 2025 · Matt Palmer (Replit, Inc.) · all sources
Moltbook, a social network for AI agents built with AI-generated code, ran a Supabase database without row-level security policies, leaving 1.5 million API tokens and 35,000 email addresses readable and writable without login.
Feb 2026 · Wiz Research · all sources
Each entry links to its primary source in the evidence list. What to do about it is the self-check below.
Stated from the vendor's documentation. The limits are the vendor's scope statements, not judgements.
Terminal allow and deny lists
windsurf.cascadeCommandsAllowList and windsurf.cascadeCommandsDenyList control which commands auto-execute; Teams and Enterprise admins can enforce a maximum auto-execution level.
Where it stops: In Turbo mode all commands not on the deny list run immediately.
vendor docs · verified 2026-09-21
Checkpoints and revert
Named checkpoints of the current state and a revert arrow to undo Cascade edits.
Where it stops: The docs state reverts are currently irreversible.
vendor docs · verified 2026-09-21
.codeiumignore
Excludes files from indexing; ignored files also do not count toward the workspace size limit.
Where it stops: Documented as an indexing control; the page describes edit blocking only for .gitignore entries.
vendor docs · verified 2026-09-21
Zero Data Retention opt-out
Paid plans can opt out of training and enable Zero Data Retention with model providers; data is encrypted in transit and at rest.
Where it stops: Opt-out is described for paid plans; the page does not describe the default for free plans.
vendor docs · verified 2026-09-21
The critical patterns first. Each uses the dashboard and your browser.
.env files, list every variable whose name starts with NEXT_PUBLIC_.NEXT_PUBLIC_ variable holding a server-only key, or a search hit for that key's value in a loaded script..env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.service_role and then for sb_secret_.supabase.co, and read the apikey header under Request Headers.Windsurf pre-launch checklist
52 checks, in the order we run them. Usable without buying anything.
Self-check tool
Answer questions about your app and get the patterns that apply, ordered by severity. Runs in your browser; nothing is sent.
For founders about to let real users in.
$490
For anyone who wants the three riskiest areas checked fast.
$290
All packages and prices. Every report includes a re-check after your fixes.
Windsurf documents terminal allow and deny lists, checkpoints and revert, .codeiumignore and a Zero Data Retention opt-out. Set the auto-execution level below Turbo for projects with production credentials, and review what App Deploys publishes.
We test the deployed app: what the public URL reveals, permission checks on routes, secrets in the bundle, database rules and payments. Fix directions are written to paste into Cascade.
Run the self-check for your stack on this site. Then check the deployed URL in a private browser window: anything you can reach without logging in, a stranger can reach too.