Lock down the data
Real row-level security written and tested per table, so a table is readable only by the people who should read it, the single most-skipped step in vibe-coded apps.
Vibe coding rescue · Windsurf
Is your Windsurf app safe to launch?
Usually not without a review. The most common holes in a Windsurf app are missing row-level security (your database readable by anyone), API keys shipped in the frontend, permission checks that run in the browser where they can be bypassed, and no rate limiting. None of these show up in a demo; all of them show up after launch. A 48-hour audit tells you exactly which you have.
AI builders optimise for a working demo, not a hostile internet. The code compiles and the happy path works, so it feels done, but the security decisions that separate a demo from a product were never made. That gap is invisible right up until the day someone curious reads your whole database or lifts a key from your frontend bundle.
Our audit is the adversarial review the tool cannot do on itself. We check data access table by table, hunt for secrets in the client, verify that permissions are enforced on the server and not just the UI, and pressure-test the auth and payment flows. You get a prioritised list of what is dangerous and one fixed price to close it before you launch, not after.
How we fix it.
Get secrets out of the client
Every API and service key shipped to the browser gets moved server-side and rotated. One lifted key is someone else running up your bill or reading your data.
Enforce permissions where they count
Access checks move from the UI (where anyone can bypass them) to the API, and public endpoints get rate limiting and input validation.
Specific to Windsurf
What usually needs attention in Windsurf apps.
Broken deploy, works locally
A Cascade edit to a build config, an env var, or a dependency runs fine on your machine and fails in production. We fix the build, pin the versions, and stand up a real deploy pipeline.
Cross-file agent drift
Cascade applies sweeping multi-file changes, and after a few of them three patterns coexist and nothing is fully reviewed. We converge it to one structure so changes stop having surprise blast radius.
Demo-grade security
Auth and data rules that pass the happy path but leave tables open, keys in the client, and permission checks in the UI. We enforce access on the server and get secrets out of the bundle.
How a rescue works.
Fixed price, milestone payments, and a written audit before you commit to anything.
Audit, 48 hours
Send repo or tool access. You get a plain-language report of what is solid, what is dangerous, what is unfinished, and a fixed price for the rest.
Fix and harden
Security first: auth, data access, secrets, rate limits, payments. The invisible work that keeps your launch out of the news for the wrong reason.
Finish and launch
The stalled features get built, the deploy pipeline gets set up, and the app goes live on your domain with monitoring, alerts, and daily backups.
Stay if you want
Every rescue includes 30 days of fixes. Many founders keep us on afterwards for the roadmap, through Resident™, our monthly retainer.
Questions
What are the most common security holes in a Windsurf app?
Four, in order: row-level security never turned on (the database is readable by anyone), API or service keys shipped in the frontend bundle, permission checks that run only in the browser, and no rate limiting on public endpoints. The audit tells you which of these your Windsurf app has.
My Windsurf app may have already leaked data. What do I do?
Treat it as an incident. We rotate exposed keys, lock down the affected tables, and assess what was reachable before anything else, then do the normal hardening pass. Book a call and flag it as urgent so we move the audit to the front of the queue.
Can you just do the audit without the full fix?
Yes. The 48-hour audit is a standalone deliverable: a prioritised, plain-language report of what is dangerous, what is missing, and a fixed price to close each item. Many founders take the report and decide from there; there is no obligation to continue.
Other Windsurf rescues.
Send us your Windsurf project.
Book a 30-minute call with a founder. Within 48 hours of access you will know what is solid, what is dangerous, and what it costs to launch.
