Windsurf Security: What Cognition Does With Your Code (2026 Review)

Type windsurf.com into a browser in 2026 and you land on devin.ai/desktop. That 308 redirect is the fastest way to understand Windsurf's security posture right now: the IDE is owned by Cognition, the company behind the Devin agent, and on June 2, 2026 it was renamed Devin Desktop. Most "is Windsurf safe" write-ups still name the wrong company.

The agent changed too, and that matters more than the name. New conversations no longer start on Cascade. They start on Devin Local, which throws out Cascade's auto-execution levels and uses allow, ask and deny rules instead. If your security notes say "set Cascade to Allowlist Only", they're describing a setting the default agent doesn't read.

Who actually owns Windsurf

The ownership story ran through three companies in about ten weeks, which is why so many pages have it wrong.

For security purposes the practical consequences are narrow but real. Your data processor is Cognition, not Codeium and not OpenAI. If you signed a Codeium enterprise agreement before mid-2025, the counterparty on your DPA has changed and is worth re-confirming. And any policy page you bookmarked under the old domain now resolves somewhere else, so re-read rather than assume.

Devin Local permissions: the setting that actually bites

Devin Local can read files, write files, run shell commands, fetch URLs and call MCP tools. How much of that happens without asking you is the highest-consequence security setting in the editor, and it's not the dropdown it used to be.

Devin Local shares its harness with Devin CLI, so it uses the CLI's permission modes. Cognition's permissions reference lists what each one approves on its own:

Two rows deserve a second look. Bypass approves every tool call with no prompt and no sandbox, so it's the old Turbo with fewer guardrails. And the File reads column says Auto everywhere. In the default mode the agent can open the .env or a private key sitting in your workspace without asking first. Writes prompt; reads don't. (By default it stays inside the workspace, so files elsewhere on your machine aren't in reach.)

Smart mode is gentler than it sounds. Cognition says installs, rm, sudo and mutating git commands always prompt in Smart, whatever the model thinks. It's also still rolling out, so you may not see it yet.

The fix for the read problem is a deny rule. Rules resolve deny first, then ask, then allow, and a deny always wins:

{
  "permissions": {
    "deny": [
      "Read(.env*)",
      "Read(**/*.pem)",
      "Write(.env*)",
      "Exec(rm -rf)",
      "Exec(sudo)"
    ]
  }
}

A project config at .devin/config.json is checked into the repo, so the rules travel with it. Your personal overrides go in .devin/config.local.json, which stays out of git.

There's a better option than both if you want unattended runs. With the OS-level sandbox on, the agent switches to Autonomous mode: shell commands auto-run, but the sandbox limits which paths they can write and which domains they can reach. Enterprise admins can require the sandbox for everyone.

MCP got stricter too. Unlike Cascade, Devin Local asks before calling any MCP tool by default, and you can allow a single tool or a whole server once you trust it.

If you're still on Cascade

Existing Cascade conversations stay available, and Cognition's FAQ said the Cascade agent would remain available "through July". If you or a teammate still runs it, its four command auto-execution levels still apply:

Turbo is allow-by-default, so your safety depends on having predicted the dangerous command in advance. The allow and deny lists match on the command name, which means allowlisting git also allows git push --force and git reset --hard. Inside a workflow file, a // turbo annotation auto-runs one command and // turbo-all auto-runs everything in it, so grep any workflows you copied from a blog post.

What leaves your machine

When you trigger a completion or send the agent a message, three things go to inference servers: the file you're editing, related context files the indexer thinks are relevant, and your prompt. Your entire repository is not being continuously uploaded.

The context engine is the part people underestimate. "Related files" is decided by an indexer, not by you, so a credentials file sitting two directories away can be pulled into context for a completion you thought was local in scope.

Ignore files are the control:

# gitignore-style syntax
.env
.env.*
secrets/
infra/terraform.tfvars
**/*credentials*.json

Three filenames work: .devinignore is current, and the legacy .codeiumignore and .windsurfignore are still read alongside it. Cognition's docs say paths in .devinignore are excluded from indexing and "cannot be viewed, edited, or created by Devin." Files listed in your .gitignore aren't indexed and can't be edited by the agent, which is a useful second layer but not a substitute, since not being editable isn't the same as not being read. Belt and braces: list secrets in .devinignore and in a Read(...) deny rule.

For an organization, a global .codeiumignore in ~/.codeium/ applies to every Devin Desktop workspace on the machine and stacks with per-repo rules. That's the version to push through your device management tooling rather than hoping each repo has its own.

On retention and training, Cognition's documentation states data is encrypted in transit and at rest, and that it "only retains data processed through Devin for the duration of the relationship with a given Customer, unless otherwise specified." The default is the part to notice: "By default, we may use your data for model training purposes." Paid users can opt out on the Data Controls settings page, and opting out also turns on Zero Data Retention with Cognition's model providers. On the Teams plan only an administrator can flip it. Enterprise customers get the stronger version: Cognition says it "will never train on your data without your express prior written consent." Its security page says it has been SOC 2 Type II certified since September 2024.

The code Windsurf writes is a separate problem

Vendor policy governs what happens to your code in transit. It says nothing about whether the code is any good, and that's where our scan data lives. In CheckYourVibe scans of apps built primarily with AI IDEs, the recurring issues are:

Completions follow the pattern already in your codebase. If the first three routes you accept skip auth checks, the next thirty will too, and the model will be confidently consistent about it. Set the pattern correctly in the early files and the same tendency works for you.

Windsurf vs Cursor vs Copilot

Day-one settings

FAQ