Live webinarWebinar with Jason Lee, Tue, Oct 13Your newest insider is an AI agent.Jason LeeFormer CISO, Zoom & SplunkRegister

Guardrails for Windsurf, built from your own rules.

Your company's rules reach Windsurf before every file write. A write that breaks them never lands.

npx -y @cybedefend/vibedefend@latest install

Create a free accountAny recent version of WindsurfRead the docs

WindsurfWindsurf is writingbilling/refund.ts

export async function refund(req: Request) {
  const { id, amount } = await req.json();
  const invoice = await db.invoices.find({
    id, tenant: req.tenant,
  });
  if (amount > 500)
    await approvals.second(invoice);
  return payments.refund(invoice, amount);
}

Every query is scoped to the tenant.

rules/data-access.md

Refunds above €500 need a second approver.

Approved once by Sofia M.

Checked before the commit: clean

Set up in four steps.

  1. Run one commandIn any terminal, on macOS, Linux or Windows. Node 18.17 or later.
  2. Choose your region, sign inEU or US. Your browser opens to sign in, no key to paste.
  3. Tick WindsurfThe installer finds the agents on your machine and ticks them for you.
  4. Code as usualOpen Windsurf: VibeDefend runs alongside it.

Check it any time: vibedefend status

What VibeDefend adds to Windsurf.

Rules served

Writes only

File writes only: pre_write_code is the moment Windsurf exposes.

WindsurfWindsurf is writingsrc/billing/cart-checkout.ts

const total = new Decimal128(cart.sum);
const rows = await db.query(
  "SELECT * FROM carts WHERE id = $1", [id]
);

Monetary amounts use Decimal128, never Number.

Mined from src/billing.ts:14

Parameterise every query that mixes user input.

OWASP Top 10

Served before the edit

Live findings

SAST, SCA, secrets, IaC and CI/CD findings, live in the session.

WindsurfWindsurf

  1. SASTsrc/db/users.repo.ts:42

    SQL injection

  2. SCApackage.json

    lodash 4.17.20, CVE-2021-23337

  3. Secretsconfig/prod.yml

    AWS access key

  4. IaCinfra/main.tf

    S3 bucket public-read

  5. CI/CD.github/workflows/deploy.yml

    pull_request_target

In the agent's context, live

Limits in Windsurf

  • Secret guardReads are not hard-blocked: a .windsurfrules snippet asks Windsurf to check them first.Through .windsurfrules
  • Action guardFile writes are hard-blocked. Shell commands rely on Windsurf following .windsurfrules.Writes only

Your questions.

Does VibeDefend change my Windsurf configuration?
It adds its hooks and registers the cybedefend MCP server, in ~/.codeium/windsurf/hooks.json, ~/.codeium/windsurf/mcp_config.json, .windsurfrules. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.
What leaves my machine?
The analysis runs in the region you chose at install, EU or US. The decision to block an action is made on your machine. Before an edit, the hook sends the part of the file being written, to find the rules that apply. The session review sends the files the session changed. Your sign-in token stays in your OS keychain.
Which version of Windsurf do I need?
A recent version of Windsurf, and Node 18.17 or later. The installer runs on macOS, Linux and Windows.
Do I need to link each repository?
Not for projects imported from GitHub or GitLab: VibeDefend reads the repo's origin and finds the project. For any other repo, run vibedefend link once. It writes .cybedefend/config.json with the project ID.
How do I remove it?
Run vibedefend uninstall: it removes every file VibeDefend installed. If you installed the package globally, then run npm uninstall -g @cybedefend/vibedefend.
Why are Action Guards limited in Windsurf?
Windsurf's pre_write_code hook can block file writes, not reads, shell commands or fetches. For those, VibeDefend adds a snippet to .windsurfrules that asks the agent to call cybe_guards_check through MCP first. It holds when the model follows its rules file.
Technical details for Windsurf
MCP server
Available~/.codeium/windsurf/mcp_config.json
Rules before each edit
Writes onlypre_write_codeFile writes only: pre_write_code is the moment Windsurf exposes.
Dangerous actions blocked
Writes onlypre_write_code.windsurfrulesWrites are hard-blocked. For reads, shell commands and fetches, a .windsurfrules snippet asks the agent to call cybe_guards_check first: it holds when the model follows its rules file.
Rules loaded at start
On each promptpre_user_promptWindsurf has no session-start event. VibeDefend uses pre_user_prompt, which fires on every turn; the check is cheap and returns at once when nothing is pending.
End-of-session review
Availablepost_cascade_responseRuns at the end of each response, once the edit threshold is crossed.
Review of long sessions
Not availableNo equivalentWindsurf has no event before compaction.
Reminder on every prompt
Not availableNo equivalentNot available in Windsurf.

What it writes for Windsurf

  • ~/.codeium/windsurf/hooks.json
  • ~/.codeium/windsurf/mcp_config.json
  • .windsurfrules

And the hook runner in ~/.cybedefend/. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.

Run the installer from your repository root: the .windsurfrules snippet is written in the folder you run it from.

Windsurf exposes fewer moments than the other agents. File writes are hard-blocked; the other actions rely on the agent following .windsurfrules.

Something off? vibedefend status gives a read-only report, and vibedefend doctor repairs what it can.