Windsurf Security: What Cognition Does With Your Code (2026 Review)

Type windsurf.com into a browser in 2026 and you land on devin.ai/desktop. That 308 redirect is the fastest way to understand Windsurf's security posture right now: the IDE is owned by Cognition, the company behind the Devin agent, and it has been renamed Devin Desktop. Most "is Windsurf safe" write-ups still name the wrong company.

Ownership matters less than one setting, though. Cascade, Windsurf's agent, has a command auto-execution level with a mode that runs terminal commands the instant the model suggests them. That's the thing to check before you worry about anybody's privacy policy.

Who actually owns Windsurf

The ownership story ran through three companies in about ten weeks, which is why so many pages have it wrong.

For security purposes the practical consequences are narrow but real. Your data processor is Cognition, not Codeium and not OpenAI. If you signed a Codeium enterprise agreement before mid-2025, the counterparty on your DPA has changed and is worth re-confirming. And any policy page you bookmarked under the old domain now resolves somewhere else, so re-read rather than assume.

Cascade agent permissions: the setting that actually bites

Cascade can write files and run terminal commands. How much it does without asking you is a single dropdown, and it's the highest-consequence security setting in the editor.

Devin Desktop offers four command auto-execution levels:

Turbo is the one to think hard about. It's an allow-by-default model: the agent runs whatever it decides to run, and your deny list is the only thing standing in the way. That means your safety depends on having predicted the dangerous command in advance. Nobody's deny list is complete.

The lists themselves are ordinary editor settings:

windsurf.cascadeCommandsAllowList   # commands that auto-execute
windsurf.cascadeCommandsDenyList    # commands that always require approval

They match on the command name, so adding git to the allow list permits git add -A, and adding rm to the deny list forces approval on rm index.py. Match granularity is the trap here: git also allows git push --force, and git reset --hard. If you allowlist a command, you allowlist all of its flags.

There's a second path into auto-execution that's easy to miss. Inside a workflow file, a // turbo annotation above a command auto-runs that one command, and // turbo-all anywhere in the file auto-runs everything in it. Both still respect the allow and deny lists. Worth grepping your workflow files for, especially any you copied from a blog post or a teammate.

What leaves your machine

When you trigger a completion or send a Cascade message, three things go to inference servers: the file you're editing, related context files the indexer thinks are relevant, and your prompt. Your entire repository is not being continuously uploaded.

The context engine is the part people underestimate. "Related files" is decided by an indexer, not by you, so a credentials file sitting two directories away can be pulled into context for a completion you thought was local in scope.

Ignore files are the control:

# gitignore-style syntax
.env
.env.*
secrets/
infra/terraform.tfvars
**/*credentials*.json

Three filenames work: .devinignore is current, and the legacy .codeiumignore and .windsurfignore are still honored, including together in the same repo. Ignored files aren't indexed and don't count against workspace indexing limits. Files listed in your .gitignore can't be edited by the agent at all, which is a useful second layer but not a substitute, since not being editable isn't the same as not being read.

For an organization, a global .codeiumignore in ~/.codeium/ applies to every Devin Desktop workspace on the machine and stacks with per-repo rules. That's the version to push through your device management tooling rather than hoping each repo has its own.

On retention and training, Cognition's documentation states data is encrypted in transit and at rest, and that it "only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified." Paid users can opt out of training on the Data Controls settings page. Enterprise customers get the stronger version: Cognition says it "will never train on your data without your express prior written consent." Cognition obtained SOC 2 Type II certification in March 2024.

The code Windsurf writes is a separate problem

Vendor policy governs what happens to your code in transit. It says nothing about whether the code is any good, and that's where our scan data lives. In CheckYourVibe scans of apps built primarily with AI IDEs, the recurring issues are:

Completions follow the pattern already in your codebase. If the first three routes you accept skip auth checks, the next thirty will too, and the model will be confidently consistent about it. Set the pattern correctly in the early files and the same tendency works for you.

Windsurf vs Cursor vs Copilot

Day-one settings

FAQ