Windsurf Security Patterns

// Mitigation steps:
// 1. Update to latest Windsurf version (patched)
// 2. Don't open untrusted repositories with Cascade enabled
// 3. Review agent actions before accepting
// 4. Disable Cascade for sensitive directories

// If building similar tools, always validate paths:
const path = require('path')
const SAFE_DIR = path.resolve('./project')

function safeReadFile(requestedPath) {
  const resolved = path.resolve(requestedPath)
  if (!resolved.startsWith(SAFE_DIR + path.sep)) {
    throw new Error('Access denied: path outside project')
  }
  return fs.readFileSync(resolved)
}

// Mitigation:
// 1. Never commit .env files (use .gitignore)
// 2. Review agent responses carefully for exposed secrets
// 3. Use secret managers instead of plaintext .env

// .gitignore (essential)
.env
.env.local
.env.*.local

// Use environment variable validation
const requiredEnv = ['DATABASE_URL', 'API_KEY']
for (const key of requiredEnv) {
  if (!process.env[key]) {
    throw new Error(`Missing required env var: ${key}`)
  }
}

// SECURE: Environment variables for all secrets
const config = {
  apiKey: process.env.API_KEY,
  databaseUrl: process.env.DATABASE_URL,
  jwtSecret: process.env.JWT_SECRET,
}

// Validate at startup
if (!config.apiKey || !config.databaseUrl || !config.jwtSecret) {
  throw new Error('Missing required environment variables')
}

// SECURE: Server-side validation with Zod
import { z } from 'zod'

const userSchema = z.object({
  email: z.string().email().max(255),
  name: z.string().min(1).max(100),
  age: z.number().int().min(0).max(150),
})

export async function POST(request: Request) {
  const body = await request.json()

  const result = userSchema.safeParse(body)
  if (!result.success) {
    return Response.json(
      { error: 'Validation failed', details: result.error.flatten() },
      { status: 400 }
    )
  }

  await db.user.create({ data: result.data })
  return Response.json({ success: true })
}

// Best Practices:
// 1. Always review agent changes before accepting
// 2. Use "Review Changes" mode for security-sensitive files
// 3. Disable Cascade for .env, config files, auth modules

// Create a .cascadeignore file (if supported):
.env
.env.*
**/auth/**
**/config/**
**/*secret*
**/*credential*