Windsurf security workflow for AI generated apps

Windsurf with Cascade can edit many files and call external MCP tools quickly, so you must lock down MCP config, tighten project rules, gate dependencies and secrets and keep SARIF for every release. This workflow covers mcp_config.json with serverUrl, Cascade memories hardening and verifiable evidence. Pair it with LyraShield as release assurance for AI built apps. Baseline controls are in our vibe coding security guide with Windsurf specific checks below.

Understand Windsurf and Cascade risk

Windsurf uses Cascade for agentic edits across files with tool awareness. Cascade can read workspace files, run commands and invoke MCP servers you configured. That speed is valuable but also means one prompt can add packages, expose data in logs or broaden network access without a clear record.

Typical AI inserted issues include debug endpoints that skip auth, error handlers that log secrets and new dependencies with install scripts. You need consistent weakness language so findings are triaged similarly across builders.

Map issues to common references. OWASP Top Ten at OWASP Top Ten captures injection and misconfiguration seen in AI generated back ends. Hardcoded credential patterns map to CWE 798 for hard coded credentials. MCP transport and auth expectations are defined at MCP specification and MCP authorization. If you also ship with visual builders, our Bolt app security checklist shows similar permission ideas adapted to a different stack.

Use the current Devin guide for supported setup

This article retains a legacy Windsurf URL. Supported setup now resolves to Devin, with desktop, cloud and local surfaces documented separately. Earlier JSON paths are withdrawn as current instructions. Do not copy legacy MCP entries into Devin or assume editor configuration proves cloud-agent connection. Follow the guide for your exact client and version.

For Devin Desktop’s local stdio path, authenticate separately with npx -y lyrashield@0.2.14 login --oauth in the same OS account and manually merge the client-specific entry using pinned @lyrashield/mcp@0.2.12. Preserve settings and symlinks. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. Restart the client, inspect discovery and call lyrashield_list_workspaces to establish authenticated read-only access. A CLI doctor result checks a separate local surface; it does not establish client discovery, sign-in or scan completion.

If you retain a legacy Windsurf installation, consult that exact vendor version’s documentation before editing its configuration. Record the version, enabled servers, selected transport and credential source. Review shared configuration as executable policy: commands run with your permissions, and endpoints receive tool arguments. Require review when server entries change, keep secrets out of source and preserve a copy of the approved configuration revision with the release record. Do not silently accept an unfamiliar server because an agent suggested it.

Local CLI OAuth and hosted client OAuth are separate sign-ins. A private read-only workspace API key does not authorize hosted mutations. Confirm the selected workspace in a read call before requesting an assessment. Keep credentials out of chat exports, transcripts and project JSON. MCP specification, OSV and GitHub SARIF support describe protocol, dependency and CI output contracts; they do not establish client acceptance.

Harden rules and workspace memories

Windsurf respects project rules in .codeium/windsurf/memories, optional muserules.md in repo root and global rules. Treat these as lightweight security policy that guides Cascade toward secure defaults.

Require these policy statements in your repo so generated code meets that bar from first commit:

Auth is required on all API routes handling user data, sessions or file access. No public bypass for local debugging remains after merge.

Input validation uses explicit libraries like zod or valibot for Node stacks, with tests for failure paths.

No shell exec with untrusted input. If exec is needed for image processing or similar, list allowed commands and sanitize args with allow list.

Package policy states allowed registries, need for lockfile audit before merge and reviewer requirement for new dependencies that introduce network access or native binaries.

Secret policy states env vars come from secret manager only, no secrets committed, no tokens pasted into Cascade summaries that get copied into tickets.

Version rules in git and require review on rules changes. When Cascade proposes broad multi file edits, split into smaller commits with tests for auth and upload paths so review stays effective.

Document the workflow in docs/contributing.md so new contributors know why rules exist and what evidence is expected per release.

Gate supply chain and secrets

Windsurf Cascade solves tasks by adding dependencies, which creates supply chain risk if auto acceptance is allowed.

Run OSV checks at OSV and npm or pnpm audit in CI on every pull request and block high severity vulnerabilities outright. Flag new packages with low weekly downloads, recent ownership change or install scripts that touch network or file system for manual review. Keep lockfile diffs readable by grouping dependency only commits separately from feature code.

For secrets, run a scanner such as gitleaks that can output SARIF and upload to GitHub code scanning. See GitHub secret scanning SARIF and upload guidance at GitHub SARIF artifact. Check env .example and mcp_config.json examples for accidental tokens and check editor logs and chat exports if pasted into issues, since tokens often leak via pasted logs.

Enforce both local pre commit hooks and CI scans. Local hooks give early feedback while CI is the gate. Require security owner review for any env file change or new MCP server addition, so token handling always gets a second set of eyes.

Build verifiable release evidence with SARIF

Collect evidence you can point to in release notes without depending on memory or private chat logs.

Repeatable per release procedure:

1. Run lint, type check, secret scan and dependency audit locally and in CI.
2. Convert each tool output to SARIF where the tool supports it.
3. Upload SARIF to GitHub code scanning so findings surface in pull request checks.
4. Add docs slash security evidence entry with date, commit hash, active MCP servers, tools run and reviewers.
5. Store build and SARIF artifacts with release tag for later reference.

See overview at GitHub code scanning and hardening ideas for web apps at Next.js security and Cloudflare fundamentals. These help frame header and auth review while your app-specific scan findings remain in SARIF.

Keep evidence for several releases so you can show trend, exception closure and repeatability of controls. If you use remote MCP, record serverUrl and version used during generation so tool output drift can be reproduced.

Control	Where configured	Verification signal
MCP config	mcp_config.json with serverUrl and env refs	No raw keys in git, least servers enabled, changes reviewed in pull request
Rules	.codeium/windsurf/memories plus muserules	Auth and validation required, destructive commands denied, tests added
Dependencies	OSV plus audit in CI	High severity blocks merge, lockfile diff reviewed, exceptions tracked
Secrets	Secret scan plus SARIF upload	No tokens in repo or logs, env via manager, example files placeholder only
Evidence	GitHub code scanning plus evidence file	SARIF on PR and main, MCP list logged, release tag linked

Why pair Windsurf with LyraShield

LyraShield AI at https://lyrashieldai.com is release assurance for AI built apps. The loop is target, review, evidence, fix, retest, report: detection stays separate from proof, recorded scans contribute to an assurance record and fix proposals are approval gated so PR execution is blocked until a server generated patch is bound to the exact approval.

MCP integration fits Windsurf. Local stdio via npx -y @lyrashield/mcp@0.2.12 runs with env var keys and remote via serverUrl https://app.lyrashieldai.com/api/mcp accepts Bearer lsk key from env. The diff-aware GitHub Action emits SARIF candidate findings in pull requests so review stays in context; it does not treat candidates as confirmed outcomes.

Build transparency: LyraShield is live in open beta with open registration. The scan pipeline, findings and evidence, approval-gated fix proposals, retests, reports, billing and Local/Desktop flows are implemented. Windsurf uses the supported config-file integration and the runner-local Action provides an advisory SARIF gate. Production availability remains bounded by release gates; automatic server-generated Fix PR execution is not enabled; self-serve checkout is live.

This pairing keeps Windsurf velocity while adding consistent verification across visual builders and IDE tools.

Release gates and next steps

Before you ship a Windsurf built release, confirm gates.

• mcp_config.json files contain no raw tokens and only needed servers are enabled.
• Rules require auth and validation and forbid risky exec with untrusted input.
• Dependency and secret scans passed and SARIF uploaded on pull request and main.
• Auth, payment or file upload changes include tests and reviewer.
• Security evidence file updated per release tag with MCP list and date.

Reuse the same evidence loop on every release with our AI app security checklist tool and create an account at https://lyrashieldai.com to start building assurance records today. For related builder patterns see V0 app security checklist and Replit app security checklist to keep controls uniform.