Security audits for Windsurf apps.
An app written with Windsurf is only as safe as the access checks its agent remembered to write. We audit the codebase and the live app: every route tested for authorisation, secrets traced, cross-account access tried with two real accounts.
Why it matters
Agentic editors like Windsurf apply changes across many files at once, and each accepted change is a set of decisions nobody itemised: this endpoint got no auth check, this response returns the whole record, this key landed client-side. The dangerous part is how these combine. A public page that leaks internal user IDs looks harmless; a route that skips the ownership check looks like an oversight. Together they are full account enumeration, one telling an attacker which IDs are real and the other letting them pull each user's private record. Neither stands out to the person who built the app, because both features work exactly as intended.
What you get.
Access control review
Every route and endpoint checked for missing or broken authorisation, then verified against the live app rather than trusted from the code.
Two-account access test
We sign in as one user and try to reach another's records by changing identifiers in requests, the test that finds cross-customer exposure no scanner can confirm.
Data leakage review
The raw responses behind public and signed-in features, checked for fields that ship but never display: internal IDs, emails and personal data that turn other flaws into a working attack.
Secrets and key handling
Keys in the client bundle or repository, privileged credentials reachable from the browser, and third-party keys with no spending limits that someone else can run up.
Configuration and hardening
Security headers, CORS, rate limiting on auth endpoints, source maps and debug routes left in production.
Prioritised report and free re-review
Every finding rated by severity with a concrete fix, and a free re-test once you have applied them.
How it works.
- 01
Access
You give us read access to the repository and a short walkthrough of what the app does and who should see what.
- 02
Review
We read the code and test the running app by hand with real accounts, not just with automated scanners.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the fix for each finding.
- 04
Re-review
After you apply the fixes, in Windsurf or by hand, we verify they hold.
Common questions.
- The agent reviewed its own changes. Isn't that enough?
- Self-review catches what the code says, not what it omits. A missing ownership check is invisible in a diff, because there is nothing there to see. It only appears when someone holds two accounts and tests the relationship between them, which is the core of this audit.
- What do you check?
- Authorisation on every route verified live, cross-account access with two real accounts, the raw data behind your features, secrets in the bundle and repository, and the configuration layer. Every finding comes with a severity and a concrete fix.
- What do you need from me?
- Read access to the repository and a short walkthrough of what the app is meant to do. Two test accounts help, though on most apps we can create our own.
- Can you fix the issues, not just find them?
- Yes. We can apply the fixes ourselves, or write each finding precisely enough to feed back into Windsurf. The free re-review confirms the result either way.
- How much does a Windsurf security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $750 depending on the size of the app. You will know the price before we begin.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.