From windsurf-pack
Implements Windsurf security best practices: .codeiumignore for excluding secrets from AI indexing, telemetry disablement, autocomplete exclusions, .windsurfrules for security policies, and workspace audits.
npx claudepluginhub jeremylongshore/claude-code-plugins-plus-skills --plugin windsurf-packThis skill is limited to using the following tools:
Security best practices for Windsurf AI IDE: controlling what code Cascade can see, preventing secrets from leaking into AI context, managing telemetry, and configuring workspace isolation for regulated environments.
Configures Windsurf AI access to code/data via .codeiumignore exclusions, telemetry settings, and compliance configs for sensitive data and regulations.
Configures code privacy, data retention policies, exclusions, and regional compliance (GDPR) for Windsurf Enterprise deployments.
Guides Next.js Cache Components and Partial Prerendering (PPR): 'use cache' directives, cacheLife(), cacheTag(), revalidateTag() for caching, invalidation, static/dynamic optimization. Auto-activates on cacheComponents: true.
Share bugs, ideas, or general feedback.
Security best practices for Windsurf AI IDE: controlling what code Cascade can see, preventing secrets from leaking into AI context, managing telemetry, and configuring workspace isolation for regulated environments.
Create .codeiumignore at project root (gitignore syntax):
# .codeiumignore — files Codeium/Windsurf will NEVER index or read
# Secrets and credentials
.env
.env.*
.env.local
credentials.json
serviceAccountKey.json
*.pem
*.key
*.p12
*.pfx
# Cloud provider configs
.aws/
.gcloud/
.azure/
# Infrastructure secrets
terraform.tfstate
terraform.tfstate.backup
*.tfvars
vault-config.*
# Customer data
data/customers/
exports/
backups/
*.sql.gz
Default exclusions (automatic): Files in .gitignore, node_modules/, hidden directories (. prefix).
Enterprise: Place a global .codeiumignore at ~/.codeium/ for org-wide exclusions.
// Windsurf Settings (settings.json)
{
"codeium.enableTelemetry": false,
"codeium.enableSnippetTelemetry": false,
"telemetry.telemetryLevel": "off"
}
Disable Supercomplete for file types that commonly contain secrets:
{
"codeium.autocomplete.languages": {
"plaintext": false,
"env": false,
"dotenv": false,
"properties": false,
"ini": false
}
}
<!-- .windsurfrules - security section -->
## Security Requirements
- Never suggest hardcoded secrets, API keys, or passwords in code
- Always use environment variables via process.env for secrets
- Never log PII (email, phone, SSN, credit card numbers)
- Use parameterized queries for all database operations
- Never suggest wildcard CORS origins in production code
- All user input must be validated before processing
- Use constant-time comparison for secret/token validation
#!/bin/bash
set -euo pipefail
echo "=== Windsurf Security Audit ==="
# Check if .codeiumignore exists
if [ ! -f .codeiumignore ]; then
echo "WARNING: No .codeiumignore — AI can index all non-gitignored files"
fi
# Check for secrets that AI could index
echo "--- Potentially exposed secret files ---"
find . -type f \
-not -path '*/node_modules/*' \
-not -path '*/.git/*' \
\( -name '*.env*' -o -name '*.key' -o -name '*.pem' \
-o -name 'credentials*' -o -name '*secret*' \
-o -name '*.tfvars' -o -name 'serviceAccount*' \) \
2>/dev/null | head -20
# Check if found files are in .codeiumignore
echo "--- Verify all above files are excluded ---"
# What Windsurf/Codeium processes:
data_processing:
indexed_locally:
- File contents for Supercomplete context
- Codebase structure for Cascade awareness
stored: "Local machine only (not sent to cloud for indexing)"
sent_to_cloud:
- Cascade prompts (for AI model inference)
- Code snippets around cursor (for Supercomplete)
stored: "Zero-data retention for paid plans"
never_processed:
- Files in .codeiumignore
- Files in .gitignore (by default)
- Files in node_modules/
compliance:
- SOC 2 Type II certified
- FedRAMP High accredited
- HIPAA BAA available (Enterprise)
- Zero-data retention on paid plans
.codeiumignore exists with secret file patterns.env files excluded from AI indexing.windsurfrules includes security coding standards| Security Issue | Detection | Mitigation |
|---|---|---|
| Secret in Cascade suggestion | Appears in AI output | Add source file to .codeiumignore, rotate secret |
| AI indexing .env files | Check .codeiumignore | Add .env* pattern |
| Telemetry sending code | Policy audit | Disable all telemetry settings |
| Dev pastes secret in chat | Cannot detect after the fact | Training + enterprise data retention = 0 |
# ~/.codeium/.codeiumignore (global, all workspaces)
*.pem
*.key
*.p12
*.env*
**/secrets/**
**/credentials/**
terraform.tfstate*
*.tfvars
# Verify critical files are excluded
echo ".env" | while read f; do
[ -f "$f" ] && grep -q "\.env" .codeiumignore 2>/dev/null && echo "$f: PROTECTED" || echo "$f: EXPOSED"
done
For production deployment, see windsurf-prod-checklist.