Windsurf Data Handling

Overview

Control what code and data Windsurf (Codeium) Cascade AI can access in your workspace. Covers file exclusion patterns, sensitive content filtering, telemetry management, and workspace privacy configuration.

Prerequisites

• Windsurf IDE installed
• Understanding of Codeium data processing
• Repository with sensitive files identified
• Team agreement on AI data boundaries

Instructions

Step 1: Exclude Sensitive Files from AI Indexing

// .windsurf/settings.json - Privacy configuration
{
  "codeium.indexing.excludePatterns": [
    "**/.env*",
    "**/credentials*",
    "**/secrets/**",
    "**/*.pem",
    "**/*.key",
    "**/*.p12",
    "**/serviceAccountKey*",
    "**/.aws/**",
    "**/.gcloud/**",
    "**/terraform.tfstate*",
    "**/*.tfvars",
    "**/vault-config*"
  ],
  "codeium.indexing.maxFileSize": 524288,  # 524288 = configured value
  "codeium.enableTelemetry": false
}

Step 2: Create Workspace Ignore File

# .codeiumignore - Files Codeium/Windsurf will never process
# Similar to .gitignore syntax

# Secrets and credentials
.env
.env.*
credentials.json
serviceAccountKey.json
*.pem
*.key
*.p12

# Customer data
data/customers/**
exports/**
backups/**

# Sensitive configuration
config/production.json
config/secrets.yaml

# Large binary files (waste of indexing)
*.zip
*.tar.gz
*.sqlite
*.db

Step 3: Environment Variable Safety

// Prevent secrets from appearing in Cascade suggestions
// .windsurf/patterns.md

/**
 * IMPORTANT: Environment Variable Patterns
 *
 * When Cascade suggests code with environment variables:
 * - Always use process.env.VARIABLE_NAME, never hardcode values
 * - For local development, use .env files (which are excluded from AI)
 * - Never paste actual secret values into Cascade chat
 *
 * Safe pattern:
 * ```
 * const apiKey = process.env.API_KEY!;
 * ```
 *
 * Unsafe pattern (never do this):
 * ```
 * const apiKey = "sk-abc123..."; // NEVER
 * ```
 */

Step 4: Telemetry and Data Controls

// .windsurf/settings.json - Telemetry controls
{
  "codeium.enableTelemetry": false,
  "codeium.enableSnippetTelemetry": false,
  "telemetry.telemetryLevel": "off",

  "codeium.autocomplete": {
    "enable": true,
    "languages": {
      "plaintext": false,
      "markdown": false,
      "json": false,
      "yaml": false,
      "env": false
    }
  }
}

Error Handling

Examples

Quick Privacy Audit

# Check what files Windsurf would index
find . -type f \
  -not -path '*/node_modules/*' \
  -not -path '*/.git/*' \
  -name '*.env*' -o -name '*.key' -o -name '*.pem' \
  | head -20
# All found files should be in .codeiumignore

Resources

• Codeium Privacy Policy
• Windsurf Configuration

Output

• Configuration files or code changes applied to the project
• Validation report confirming correct implementation
• Summary of changes made and their rationale