Security for code written with Windsurf: the check to add

Windsurf’s agent chains changes across several files at once. The result works, but security depends on what wasn’t asked for: input validation, access rights, package updates.

Citadel reviews the whole project with deterministic rules and gives you, for each flaw, a plain explanation and the prompt to hand back to the agent.

Ten free analyses every month, no card needed. First report in minutes.

Analyse my app for free

The most common flaws

Secrets in the code

100+ types of keys and tokens detected: cloud, payments, AI, databases.

Injections

SQL, system commands, eval: external data must never be executed.

XSS in React components

HTML injected from external data: session theft follows.

Vulnerable dependencies

Every version compared against public vulnerability databases (CVE, GHSA).

What Citadel checks (24 live checks)

Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.

Next.js version vulnerable to middleware bypass (CVE-2025-29927) A06 · CVE
Secret exposed in a NEXT_PUBLIC_ variable CWE-200 · A02
dangerouslySetInnerHTML fed with external data CWE-79 · A03
Redirect built from URL parameters CWE-601 · A01
images.remotePatterns open to every domain CWE-918 · A10
Source maps published in production CWE-540 · A05
child_process.exec or spawn with user input CWE-78 · A03
eval, new Function or vm on external data CWE-95 · A03
File path built from the request (path traversal) CWE-22 · A01
JWT verified without an algorithm allow-list or with a weak secret CWE-347 · API2
Session cookies without HttpOnly, Secure or SameSite CWE-1004 · CWE-614
CORS: * origin combined with authentication cookies CWE-942 · A05
Secrets in the code and config files (100+ key types) CWE-798 · A07
npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
http:// redirects to https:// CWE-319 · A02
HSTS present with a sufficient duration CWE-319 · A05
CSP present, without unsafe-inline or unsafe-eval CWE-693 · A05
Protection against embedding in another page (clickjacking) CWE-1021 · A05
Secure, HttpOnly and SameSite cookies CWE-614 · CWE-1004
CORS open to every site with cookies CWE-942 · A05
nosniff and Referrer-Policy headers, server version hidden CWE-693 · CWE-200
Forms sent in clear text, or password passed in the URL CWE-319 · CWE-598
Forms without an anti-CSRF token, or sent to another domain CWE-352 · CWE-201

Frequently asked questions

Is my code kept?

No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.

How much does it cost?

The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.

Other guides

Vibe coding security: the checklist before you put your app online

By tool

By technology