Security audits for Windsurf apps.
An app written with Windsurf is only as safe as the access checks its agent remembered to write. We audit the codebase and the live app: every route tested for authorisation, secrets traced, cross-account access tried with two real accounts.
Why it matters
Agentic editors like Windsurf apply changes across many files at once, and each accepted change is a set of decisions nobody itemised: this endpoint got no auth check, this response returns the whole record, this key landed client-side. The dangerous part is how these combine. A public page that leaks internal user IDs looks harmless; a route that skips the ownership check looks like an oversight. Together they are full account enumeration, one telling an attacker which IDs are real and the other letting them pull each user's private record. Neither stands out to the person who built the app, because both features work exactly as intended.
What you get.
Access control review
Every route and endpoint checked for missing or broken authorisation, then verified against the live app rather than trusted from the code.
Two-account access test
With dedicated accounts and synthetic records, we test allowed and denied access across customer boundaries and validate what the backend returns. Automated checks support this work; the product's intended permissions define the expected result.
Data leakage review
The raw responses behind public and signed-in features, checked for fields that ship but never display: internal IDs, emails and personal data that turn other flaws into a working attack.
Secrets and key handling
Keys in the client bundle or repository, privileged credentials reachable from the browser, and third-party keys with no spending limits that someone else can run up.
Configuration and hardening
Security headers, CORS, rate limiting on auth endpoints, source maps and debug routes left in production.
Prioritised report and free re-review
Every finding rated by severity with a concrete fix, and a free re-test once you have applied them.
How it works.
- 01
Access
You give us read access to the repository and a short walkthrough of what the app does and who should see what.
- 02
Review
We read the code and test the running app by hand with real accounts, not just with automated scanners.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the fix for each finding.
- 04
Re-review
After you apply the fixes, in Windsurf or by hand, we verify they hold.
Common questions.
- The agent reviewed its own changes. Isn't that enough?
- Agent review can identify missing checks and other vulnerabilities. The question is whether the review covered the intended business rules and validated the result. We agree that model, test relevant account and role boundaries, and document the evidence and untested areas.
- What do you check?
- Authorisation on every route verified live, cross-account access with two real accounts, the raw data behind your features, secrets in the bundle and repository, and the configuration layer. Every finding comes with a severity and a concrete fix.
- What do you need from me?
- Read access to the repository and a short walkthrough of what the app is meant to do. Two test accounts help, though on most apps we can create our own.
- Can you fix the issues, not just find them?
- Yes. We can apply the fixes ourselves, or write each finding precisely enough to feed back into Windsurf. The free re-review confirms the result either way.
- How much does a Windsurf security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $750 depending on the size of the app. You will know the price before we begin.
Related services and guides.
Know what needs fixing before you ship.
Get a scoped developer review, evidence-backed findings and remediation guidance, with a free re-review of agreed fixes. Fix implementation is quoted separately.