Builder
Windsurf
Windsurf keeps the agent close to your editor. The review habit is still the product.
What the builder handles for you
Agent edits inside your project.
Context from the open files.
What it does not
It does not deploy or set headers.
It does not check a package name before importing it.
It does not test sign in or payments.
Incidents involving it
The Tenzai study covered five AI coding tools and found 69 vulnerabilities across 15 apps.
126 malicious npm packages exploited names AI tools hallucinate.
The fix prompt dialect
Windsurf uses the generic prompt: one instruction, one place to change, one way to verify.
Stack checklists that apply
Cursor, Next.js, Supabase, Vercel.
Incidents involving this builder
No incident in the library maps to this one yet.
Checklists that apply
Run the free Launch Risk Check on your app
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026