Smithery is now a part of Arcade.dev! Read more in our announcement here
Apply Windsurf security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Windsurf security configuration. Trigger with...
Devin Desktop is the current name for Windsurf. Secure it with layered controls: repository permissions and secret management are authoritative; .codeiumignore, Rules, and prompts reduce context exposure but do not replace access control.
Read to inspect only the repository files and configuration needed for the request.Grep to locate relevant settings, rules, logs, or code without broad collection.Write only for a new artifact the user requested; never write credentials or unreviewed production configuration.Record repository sensitivity, connected organizations, enabled models, MCP servers, Hooks, terminal permissions, remote indexing, and deployment integrations. Identify which controls are local, repository-owned, or centrally administered.
Create .codeiumignore at the repository root using gitignore syntax. Include only project-relevant patterns, for example:
.env
.env.*
*.pem
*.key
credentials/
secrets/
customer-data/
dist/
node_modules/
Windsurf also honors .gitignore, and Enterprise administrators can add a global .codeiumignore under ~/.codeium/. Verify behavior with a harmless canary filename; do not place a real secret in the test.
Use repository AGENTS.md or .devin/rules/*.md to require secure coding, validation, least privilege, and explicit approval for risky operations. Keep each workspace Rule within the documented 12,000-character limit and use the correct trigger: mode.
mcp_config.json.If a secret appears in a prompt, output, log, diff, or diagnostic bundle, treat it as exposed: stop sharing, revoke or rotate it through the provider, remove it from history where authorized, and document the incident. Adding an ignore rule alone is not remediation.
Confirm ignored paths are absent from context, protected branches still require review, MCP tools match policy, Hooks run on representative success and failure paths, and no configuration file contains credential material.
Deliver a security review with context boundaries, ignored paths, organization policy, MCP and Hook exposure, repository protections, detected secret locations without values, remediation owners, and verification evidence. Mark controls as preventive, detective, or corrective.
| Issue | Response |
|---|---|
| Ignored file still appears | Check syntax, location, gitignore interaction, and current indexing state |
| MCP requires a token | Use provider OAuth or an approved secret store; never commit the value |
| Hook blocks legitimate work | Preserve the event, fix the narrow rule, and retest failure handling |
| Compliance claim is uncertain | Link first-party evidence and route the decision to security or legal |
Finding: ".env.production was not excluded. Add .env.*, rotate any exposed credential, verify with a harmless canary, and retain protected-branch review as the enforcement boundary."
Continue with windsurf-data-handling to build a regulated-data inventory, verify mutable vendor claims, and record control evidence without exposing sensitive values.
