| name | windsurf-security-basics |
| description | Apply Windsurf security best practices for workspace isolation, data privacy, and secret protection.
Use when securing sensitive code from AI indexing, configuring telemetry,
or auditing Windsurf security posture.
Trigger with phrases like "windsurf security", "windsurf secrets",
"windsurf privacy", "windsurf data protection", "codeiumignore".
|
| allowed-tools | Read, Write, Grep |
| version | 1.11.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","windsurf","security","privacy","compliance"] |
| compatibility | Designed for Claude Code |
Windsurf Security Basics
Overview
Security best practices for Windsurf AI IDE: controlling what code Cascade can see, preventing secrets from leaking into AI context, managing telemetry, and configuring workspace isolation for regulated environments.
Prerequisites
- Windsurf installed
- Understanding of Codeium's data processing model
- Repository with identified sensitive files
Instructions
Step 1: Exclude Secrets from AI Indexing
Create .codeiumignore at project root (gitignore syntax):
# .codeiumignore — files Codeium/Windsurf will NEVER index or read
# Secrets and credentials
.env
.env.*
.env.local
credentials.json
serviceAccountKey.json
*.pem
*.key
*.p12
*.pfx
# Cloud provider configs
.aws/
.gcloud/
.azure/
# Infrastructure secrets
terraform.tfstate
terraform.tfstate.backup
*.tfvars
vault-config.*
# Customer data
data/customers/
exports/
backups/
*.sql.gz
Default exclusions (automatic): Files in .gitignore, node_modules/, hidden directories (. prefix).
Enterprise: Place a global .codeiumignore at ~/.codeium/ for org-wide exclusions.
Step 2: Disable Telemetry (If Required)
{
"codeium.enableTelemetry": false,
"codeium.enableSnippetTelemetry": false,
"telemetry.telemetryLevel": "off"
}
Step 3: Configure AI Autocomplete Exclusions
Disable Supercomplete for file types that commonly contain secrets:
{
"codeium.autocomplete.languages": {
"plaintext":
