SCAN YOUR WINDSURF APP FOR VULNERABILITIES

Windsurf is Codeium’s AI IDE, and its Cascade agent is the reason people use it: one prompt can plan, edit a dozen files, install packages, and run the build. The app that comes out the other side is a conventional web app in whatever stack you asked for — Next.js or Express on Node, FastAPI or Flask on Python, Rails, Go — deployed to Vercel, Railway, Fly, or your own VPS. Windsurf the IDE is not the attack surface. The deployed app is.

The failure mode is the review gap. Cascade’s diffs are large and plausible-looking, so reviewers skim them, and the security-relevant absences — the auth check that never got written, the CSRF middleware that got dropped during a refactor, the server-side validation that only exists on the client — ship silently. Nobody typed the vulnerable line, so nobody flags it in review.

A black-box scan closes that gap from the other side: it attacks the deployed URL the way an attacker would, and it doesn’t care which of the twelve files in the Cascade diff introduced the hole.

Common vulnerabilities we find in Windsurf apps

The recurring shapes below come straight from auditing Cascade-heavy repos and the apps they deploy.

Broken object-level authorization (BOLA)

Cascade-generated CRUD routes check that a session exists, then look up the resource by ID and return whatever they find — including records owned by other users. The exploit is trivial: sign in as user B, copy a request containing user A’s record UUID, and replay it. If the API returns A’s data, every record in the table is enumerable.

The fix is an ownership check on every ID-keyed route, not just a session check:

const project = await db.projects.findOne({ id: req.params.id });
if (project?.owner_id !== req.user.id) return res.status(403).end();

This is the most common finding in agent-built backends — see BOLA in AI-generated CRUD.

Silently dropped security middleware

Cascade’s signature regression: you ask it to “support JSON bodies” or “make this endpoint faster,” and the rewritten handler no longer mounts the CSRF check or rate limiter that lived on the old code path. The diff spans twelve files, the change looks plausible, and the reviewer skims. The exploit shape is a cross-origin POST that a form-only route would have rejected last week and now accepts.

Fix direction: mount CSRF and auth middleware at the app or router level so rewritten routes inherit them, and add a CI gate that fails when security calls disappear from a diff:

git diff origin/main...HEAD -- 'src/middleware/**' 'src/auth/**' \
  | grep -E '^-.*(requireAuth|csrf|verifyJwt)\(' && exit 1 || true

Secrets pasted during prompting sessions

Keys leak into Windsurf projects two ways: developers paste them into prompts, .windsurfrules, or @-mentioned config files “just to give context,” and Cascade hardcodes keys it sees in nearby example code instead of switching to environment variables. Either way, sk_live_, AIza, or a JWT signing secret ends up in source — and often in the shipped client bundle, where anyone can read it with view-source.

Grep the repo and the built bundle for key prefixes, move everything server-side, and rotate anything that ever appeared in a prompt or in git history:

grep -rE 'sk_(live|test)_|AIza[A-Za-z0-9_-]{35}|eyJ[A-Za-z0-9]' dist/ src/

Client-side-only validation

Cascade generates a React form with a perfect Zod schema, then generates a server handler that trusts the body without re-validating. Anyone with curl bypasses the form entirely: oversized payloads, injected SQL in string fields, negative numbers in quantity fields.

The fix is mechanical — re-validate at the route boundary and reject with a 400 before the input touches the database:

const parsed = CreateOrder.safeParse(req.body);
if (!parsed.success) return res.status(400).end();

Hallucinated and vulnerable dependencies

Cascade installs packages to solve small problems, and it sometimes names packages that don’t exist — a gift to typosquatters who register the hallucinated name with malicious code. It also pins nothing, so known-CVE versions ride along into the lockfile.

Diff package.json after every session, verify unfamiliar packages exist on the registry with a real publish history, and run npm audit / pip-audit before deploy. The Package Hallucination Scanner automates the phantom-package check.

Exposed source maps and debug artifacts

Agent-built deploys frequently ship with production source maps, verbose error handlers that return stack traces, and stray .git/ or config files under the web root. Each one hands an attacker your file layout, stack versions, and sometimes credentials embedded in bundled source.

Disable source maps in production builds, return generic 500s, and confirm nothing under the web root serves repo internals — see source maps and exposed .git.

How VibeEval works with Windsurf

1. Enter your deployed URL. Paste the address of your staging or production deploy — Vercel, Railway, Fly, or anywhere else. No repo access, no SDK, no framework assumptions.
2. The agent attacks it like a user with bad intentions. A browser-driven agent signs up, logs in, and probes the running app: replaying cross-user requests to find BOLA, checking bundles and responses for leaked keys, testing security headers and CORS, and hitting API routes directly to catch validation and auth gaps the UI hides.
3. You get findings with severity and paste-ready fix prompts. Each finding explains what was reached, how, and how bad it is — plus a remediation prompt written to be pasted straight back into Cascade, so the same agent that introduced the gap closes it.

Manual testing vs VibeEval

Manual review still matters: only a human knows whether the logic is right. The scanner wins on repeatability — Cascade can regress security in any session, and re-running a scan after every agent run is cheap in a way that re-reading every diff is not.

Frequently asked questions

Can I use VibeEval while developing in Windsurf?

Yes. The usual loop is: let Cascade work in a feature branch, deploy to a preview or staging URL, and scan that URL before merging. Findings come with fix prompts you can paste back into Cascade, so remediation stays inside the same workflow.

Does Windsurf produce insecure code?

Windsurf the IDE is safe, and Codeium holds SOC 2 Type II. But Cascade’s output shows the same patterns as every AI coder — missing ownership checks, client-only validation, hardcoded keys — plus a Cascade-specific one: large autonomous diffs that silently drop existing security middleware. See Is Windsurf Safe? for the full analysis.

What stacks does VibeEval support for Windsurf apps?

Any of them. Because the scan is black-box against the deployed URL, it works regardless of whether Cascade wrote you a Next.js app, an Express API, a FastAPI backend, or a Rails monolith. The vulnerabilities it hunts — BOLA, leaked keys, missing headers, unvalidated input — are protocol-level, not framework-level.

When should I scan — after every Cascade session?

Scan before every deploy at minimum, and after any Cascade session that touched auth, payments, or data access. Autonomous multi-file edits are exactly when regressions land, and a scan is the cheapest way to confirm the deployed app still rejects what it rejected yesterday.

How do I fix what the scanner finds?

Each finding includes the evidence (what was accessed and how) and a paste-ready fix prompt. Feed the prompt to Cascade, review the resulting diff, redeploy, and re-scan to confirm the finding is closed.

Related Windsurf resources

• How to Secure Windsurf — hardening the IDE itself: Cascade approval modes, .codeiumignore, telemetry, and extension audit.
• Is Windsurf Safe? — in-depth analysis of the Cascade agent, MCP permissions, and where the real risk lives.
• Windsurf Security Checklist — pre-launch checklist for Cascade-authored code, from migrations to middleware regressions.
• Package Hallucination Scanner — check whether an AI-suggested dependency actually exists.
• Vibe Code Scanner — the general-purpose scan for any AI-built app.

Test your Windsurf app before launch

Cascade ships features faster than anyone can read the diffs. Point VibeEval at your deployed URL and find the missing auth checks, leaked keys, and cross-user data exposure before your users — or someone less friendly — find them first.