Windsurf app security check
Built your app with Windsurf? Paste your live link, on netlify.app, windsurf.build or your own domain, and get a free score before you share it. Under a minute, no signup.
Only scan apps you own or have permission to scan.
What we don't check
We don't read your repo, connect to your Windsurf project, log in, or run a pentest. The scan only sees what your live site serves to a logged-out visitor.
It uses ordinary read requests only, with no exploit payloads and no form submissions. A good score is a useful signal, not a guarantee of security.
What the free scan checks
- Leaked keys in your frontend
Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.
- Supabase service_role key
A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.
- Files left on the server
Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.
- Public source maps
We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.
- Security headers and CORS
HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.
- Open tables (owner opt-in)
If you use Supabase, tick the extra box and we ask 15 common table names (like users, profiles, orders) for 1 row using your public anon key. Row contents are never stored or shown.
Windsurf pre-launch checklist
- Keep secrets on the server. Put secret keys in server functions or Netlify environment variables. Never use VITE_ or NEXT_PUBLIC_ variables for secrets, since those end up in the browser.
- Keep the service role key server only. A Supabase service_role key should never appear in frontend code or a public variable.
- Turn off production source maps. Make sure your production build doesn't publish .map files.
- Add a _headers file. On Netlify, add a _headers file that sets HSTS, Content-Security-Policy, X-Content-Type-Options and Referrer-Policy.
- Don't deploy .env or .git. Check that .env files and the .git folder are not in your publish directory.
- Turn on RLS everywhere. If you use Supabase, turn on Row Level Security for every table.
- Run the free scan. Fix anything critical or high first, then rotate any key that was ever exposed.
FAQ
- Does it work for Netlify and windsurf.build sites?
- Yes. It works for any public URL, including netlify.app, windsurf.build and custom domains.
- Does it read my code?
- No. It only sees what your live site serves to a logged-out visitor. It never connects to your repo, your editor or your accounts.
- How long does it take?
- Under a minute.
- Do I need an account?
- No. Paste your link, confirm it's your app (or you have permission), and run it.
- What does it cost?
- The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
- Does it attack my site?
- No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.