windsurf-security-basics

# Windsurf Security Basics ## Overview Security best practices for Windsurf AI IDE: controlling what code Cascade can see, preventing secrets from leaking into AI context, managing telemetry, and configuring workspace isolation for regulated environments. ## Prerequisites - Windsurf installed - Understanding of Codeium's data processing model - Repository with identified sensitive files ## Instructions ### Step 1: Exclude Secrets from AI Indexing Create `.codeiumignore` at project root (gitignore syntax): ```gitignore # .codeiumignore — files Codeium/Windsurf will NEVER index or read # Secrets and credentials .env .env.* .env.local credentials.json serviceAccountKey.json *.pem *.key *.p12 *.pfx # Cloud provider configs .aws/ .gcloud/ .azure/ # Infrastructure secrets terraform.tfstate terraform.tfstate.backup *.tfvars vault-config.* # Customer data data/customers/ exports/ backups/ *.sql.gz ``` **Default exclusions (automatic):** Files in `.gitignore`, `node_modules/`, hidden directories (`.` prefix). **Enterprise:** Place a global `.codeiumignore` at `~/.codeium/` for org-wide exclusions. ### Step 2: Disable Telemetry (If Required) ```json // Windsurf Settings (settings.json) { "codeium.enableTelemetry": false, "codeium.enableSnippetTelemetry": false, "telemetry.telemetryLevel": "off" } ``` ### Step 3: Configure AI Autocomplete Exclusions Disable Supercomplete for file types that commonly contain secrets: ```json { "codeium.autocomplete.languages": { ...