Security for apps built with Windsurf

Windsurf (Codeium) writes code fast like Cursor but doesn't police your .gitignore. The most common problem is an uncommitted ignore list that ships internal rules (.windsurfrules) and .env with your keys straight to production.

A scan from your public URL finds them and offers a Windsurf-specific fix: add .windsurfrules, .windsurf/ and .env* to .gitignore and your build ignore, move keys to .env.local plus your host's env vars, and route AI calls through your own backend.