Built with Windsurf
Check a site you built with Windsurf
An agent that edits many files at once makes changes that are individually sensible and collectively leaky. Nothing in the editor tells you how the deployed result behaves, and reviewing a large diff carefully is exactly what nobody does at the end of a long session.
Free website audit — no account
Find out what your website is giving away.
Paste your address. In about a minute you will see everything that is exposed, broken, or quietly costing you customers — and the exact fix for each one.
Not ready
Two things here need fixing before anyone visits.
Your payment password is visible to anyone
It is sitting in your website’s code, where any visitor can read it.
A settings file can be downloaded by anyone
It contains the keys to your database.
Your security certificate expires in 9 days
Visitors will see a red warning page when it does.
Google is told not to show 4 of your pages
Almost certainly a mistake left over from building the site.
7 pictures have no description
People using a screen reader cannot tell what they are.
What tends to go wrong on Windsurf
None of this means you did something careless. These are the defaults.
Credentials committed while iterating
A key pasted in to get something working locally is easy to commit and hard to spot as one line among hundreds of changed ones.
Environment variables exposed to the client
A variable given a public prefix to fix a build error is compiled into the browser bundle, and the build then succeeds, so nothing flags it.
Routes without ownership checks
Endpoints generated for a single caller are the most common place an authorisation check is missing entirely.
Configuration that drifted
Headers, redirects and cache rules adjusted to fix one problem are rarely reviewed as a whole afterwards.
Every fix is written for Cursor
Findings do not stop at telling you something is wrong. Each one comes with the change to make, in five versions — including one you can paste straight into Cursor and one written with no jargon at all.