← Back to Guides

    How to Secure Windsurf

    Step-by-step guide to securing your Windsurf IDE and the applications you build with it.

    Windsurf Security Context

    Windsurf is built on Chromium, which had 94 CVEs discovered in 2024-2025. It uses Codeium's AI which offers zero data retention mode. Keep your IDE updated and review all AI-generated code.

    Security Checklist

    1

    Enable zero data retention mode

    Critical

    Configure Codeium's zero data retention mode to prevent code from being stored.

    2

    Keep Chromium updated

    Critical

    Windsurf uses Chromium - ensure it's updated to avoid the 94+ CVEs discovered in 2024-2025.

    3

    Review AI-generated code

    Critical

    All AI-generated code should be reviewed for security vulnerabilities.

    4

    Configure ignore patterns

    Critical

    Set up ignore patterns to exclude sensitive files from AI analysis.

    5

    Audit secrets exposure

    Critical

    Ensure API keys and credentials aren't exposed to the AI.

    6

    Review Codeium permissions

    Critical

    Understand what data Codeium accesses and how it's handled.

    7

    Configure workspace settings

    Set up workspace settings to limit AI access to sensitive directories.

    8

    Enable security extensions

    Install security-focused extensions for additional protection.

    9

    Review generated dependencies

    Audit packages suggested by AI for vulnerabilities.

    10

    Configure git hooks

    Set up pre-commit hooks for secret detection.

    11

    Audit extension permissions

    Review what extensions have access to your codebase.

    12

    Enable code signing

    Sign commits to verify code authenticity.

    13

    Review telemetry settings

    Configure telemetry to minimize data sharing.

    14

    Secure remote connections

    Audit remote development connections.

    15

    Run security scan

    Use VibeEval to scan your deployed application.

    Related Resources

    Is Windsurf Safe?

    In-depth security analysis of Windsurf.

    Windsurf Security Checklist

    Interactive pre-launch security checklist.

    Automate Your Security Checks

    Let VibeEval scan your application and generate a comprehensive security report.

    Scan Your App