Windsurf rescue

Windsurf doesn't exist anymore. The codebase it built still does.

Windsurf, as a product name, stopped existing on June 2, 2026 — Cognition, the company behind Devin, acquired it in mid-2025 and renamed it Devin Desktop via a silent update that changed existing installs overnight. If you built something in what you still think of as Windsurf, the tool's identity has already moved on without you, but the codebase hasn't. We fix what's actually in the repo, regardless of what the editor that wrote it is called this month.

Send us the repo Read the FAQ

Founder

“You clicked 'Reject' and it deleted the file anyway.”

Auditor

“A fix attempt kept retrying and kept charging you for it.”

Engineer

“The agent forgot something you told it earlier in the same session.”

Investor

“A hidden file could read or write anything on disk.”

Co-founder

“The editor quietly registered a tool server you never approved.”

Hire

“It's built on a browser engine with dozens of known, patched holes.”

If you see this, this is you

The signals.
What they actually mean.

“You clicked 'Reject' and it deleted the file anyway.”

One detailed, dated first-person account: explicitly rejecting a change still deleted an entire working file at least twice, requiring git-history recovery. The same account describes the AI rewriting previously-working code while adding unrelated features.

“A fix attempt kept retrying and kept charging you for it.”

A March 2025 report, cross-referenced across Discord and Reddit at the time: the edit tool failing roughly 40 percent of the time while still consuming credits on every retry. One user described their credits gone in two to three days of light use.

“The agent forgot something you told it earlier in the same session.”

Documented in the same first-person account: database schema information supplied earlier repeatedly had to be re-explained, and an unrequested route redirect went out without confirmation.

“A hidden file could read or write anything on disk.”

CVE-2025-62353, CVSS 9.8: a path-traversal bug in Windsurf's own file tools allowed arbitrary file read and write, reachable through a prompt hidden in something as ordinary as a README, even with auto-execution turned off.

“The editor quietly registered a tool server you never approved.”

CVE-2026-30615: malicious HTML content processed by the editor could inject a command that auto-registered a malicious MCP server and executed commands with it, disclosed in April 2026.

“It's built on a browser engine with dozens of known, patched holes.”

The same October 2025 finding that named Cursor also named Windsurf: 94-plus already-patched Chromium vulnerabilities inherited from an old Electron base. Researchers said Windsurf didn't respond to the disclosure at all.

Our process

Five steps. 14 days.

012 days

Audit

We identify what version and rebrand-state your codebase was actually built under, Windsurf, early Devin Desktop, whichever, since the fixes available depend on that. We check for hidden-file prompt injection risk and any auto-registered MCP servers.

021 day

Triage

Keep, rewrite, delete. This tends to run 60/30/10 — the multi-file editing this tool was known for is usually structurally sound, the trust boundaries around it usually aren't.

035–8 days

Foundation

File tools get locked to actual project boundaries. MCP auto-registration gets disabled or scoped. We rebuild anything that was silently rewritten during a prior fix that quietly broke something else.

042–3 days

Migration

We verify the corrected setup against real usage before cutover, since a session that 'forgot' context earlier is exactly the kind of thing that needs re-verifying, not re-trusting.

051 day

Handoff

Documented, tested, CI green. Whatever the editor is calling itself by the time you read this, the codebase is yours and it works without it.

What we do with the code

Three piles. Honest splits.

Keep

60%

Multi-file structure and UI work, genuinely one of this tool's strengths, and it usually holds up.

Rewrite

30%

File-access boundaries, MCP configuration, anything touched by a silent rewrite during a prior fix attempt.

Delete

10%

Orphaned code from an unrequested redirect or a rewrite that duplicated existing logic.

Verdict

Who this is for.

The tool you built this in doesn't exist under that name anymore. Cognition acquired it after its own leadership left for a competitor and a reported $3B acquisition by someone else fell through, then renamed it to Devin Desktop, automatically, for every existing install. Whatever support and fix timeline you were expecting from "Windsurf" now runs through a different company's roadmap. Independent of the rebrand, the tool built a real reputation for strong multi-file, cross-editor agentic editing, available across 40-plus IDEs, not locked to one fork, which is a genuine differentiator most competitors don't offer. The failure pattern sits specifically at the trust boundary: file access, MCP auto-registration, and a security-disclosure history where responses were, more than once, publicly reported as slow or absent. If your app was built recently, under the new Devin Desktop branding, some of this may already be patched, we check the specific version before assuming anything. If it's an older Windsurf-era build nobody's touched since the rename, that's exactly the kind of codebase we take on.

FAQ

Questions founders ask.

Wait, Windsurf doesn't exist anymore?

Not under that name. Cognition (the Devin company) acquired it in mid-2025 and renamed the editor Devin Desktop in June 2026. Your codebase is unaffected by the name change — it still needs the same audit either way.

Is my app affected by the file-access CVE?

Depends on the version it was built with and whether it's been updated since. We check this directly as part of the audit rather than assuming either way.

Do you rebuild the whole app?

No. About 60 percent typically stays, the multi-file editing this tool does well tends to hold up. We focus on the trust and access boundaries around it.

Can I keep using Devin Desktop (formerly Windsurf) after the fix?

Yes. We lock down file access and MCP auto-registration so the tool keeps its strengths without the specific risk pattern that's been publicly documented.