Windsurf Security Scanner
Is my Windsurf app secure?
Windsurf's agent edits across many files in one pass, which makes it easy to ship a working feature and hard to notice that no step in the chain ever added throttling, a CSRF token, or an ownership check. This scanner takes your deployed URL and tests for those missing controls the only way that proves anything - by sending the requests they were supposed to refuse.
What we check on a Windsurf-built app
Routes with no observable throttling
Sends repeated requests to sensitive-looking routes and reports when nothing slows, blocks, or challenges them.
Forms posting without a CSRF token
Inspects forms on your public pages for an anti-CSRF token and flags state-changing forms that post without one.
Endpoints answering without a session
Probes JSON, debug, and admin-looking paths unauthenticated, and checks which HTTP methods each route unexpectedly accepts.
Read more →Secrets in the shipped bundle
Matches your deployed JavaScript against key patterns for 30+ providers, plus generic secret-shaped assignments.
Read more →Session handling in the browser
Flags JWTs and secrets written to localStorage, cookies missing HttpOnly, Secure, or a strict SameSite, and cacheable authenticated pages.
Read more →Dependencies, headers, and TLS
Frontend library versions with known vulnerabilities, CSP and HSTS coverage, CORS behaviour, and certificate health.
Read more →How the Windsurf Security Scanner works
- Step 1
Paste your deployed app URL
Your live URL only. No repository access, no Windsurf workspace, no CI integration, no environment variables, and no Ubserve account.
- Step 2
We test the running app, not the code
We fetch the page, download and scan the JavaScript it serves for provider keys and stored tokens, read your forms for CSRF tokens, send repeated and unauthenticated requests at sensitive routes to see what is throttled and what answers, and check dependency versions, headers, cookies, CORS, and TLS.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my Windsurf app is missing security controls?
Send the requests the controls were meant to stop. Hit a sensitive endpoint repeatedly and see whether anything throttles you. Call an API route in a private window with no session and see whether it returns data. Post a state-changing form without the token your app issued. A missing control leaves nothing in the code to review, so the only reliable evidence is the response your deployed app gives to a request it should have refused.
Why do agentic coding tools leave controls out?
Because they optimise for a working result across the files a task touches. An agent given 'build account settings' will produce a form, a route, and a database call that all function - and functioning is the goal it can verify. Rate limiting, CSRF tokens, and ownership checks are constraints that change nothing about whether the feature works, so nothing in the loop surfaces their absence. The more files an agent edits in one pass, the easier it is for that gap to pass review as finished work.
How does the scanner work?
It runs the standard Ubserve public scan against your deployed URL. We fetch the page, download and scan the JavaScript bundles for provider keys and browser-stored tokens, read your forms for CSRF tokens, send repeated requests at sensitive routes to detect missing throttling, probe API and debug paths unauthenticated, and check dependency versions, security headers, cookies, CORS, and TLS - all from outside, against your public URLs.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my source code or my Windsurf workspace?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
Will scanning break my app or lock me out of my account?
No. The repeated requests used to detect missing throttling are ordinary reads, not login attempts with credentials, so nothing locks an account. We never insert, update, or delete data and we never create a user. Probes are paced a couple at a time with pauses between them rather than fired in a burst.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →
AI BuildersCursor Security Scanner
Checks a Cursor-built app for the protections the model never mentioned: throttling, CSRF tokens, and access control.
Open tool →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →Website Vulnerability Scanner
The full public scan: bundles, headers, TLS, CORS, endpoints, DNS, and database exposure in a single pass.
Open tool →Keep reading
- Windsurf security checklistLaunch checks for Windsurf-generated builds.
- Windsurf vs Cursor: security comparedWhat each assistant tends to leave out.
- AI agent security best practicesGuardrails for tools that edit many files at once.
- Broken access control in AI-built appsThe check that gets skipped most often.
- Pre-deploy security checklist for vibe-coded appsThe last pass before you ship.
Run the Windsurf Security Scanner
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.