Why do Windsurf's docs open on docs.devin.ai?

docs.windsurf.com now redirects to docs.devin.ai/desktop, where Cognition documents the editor under the Devin Desktop name. The MCP setup that Supabase's guide refers to is described there.

Which Supahound alerts start as soon as I connect?

Cross-tenant reads, service-key misuse, credential stuffing and database tampering alert from day one. Behavioral detectors such as scraping learn your traffic for 7 days before they alert.

Windsurf + Supabase

Monitor the Supabase backend behind your Windsurf project

Windsurf (now documented as Devin Desktop) has no Supabase flow of its own. You add Supabase's MCP server on the Customize > MCPs page or in .devin/mcp_config.json, and that one entry decides how much of your project the agent can touch. Keep it to one project and read-only. Supahound reads the same project from the other side: a free daily RLS scan, plus live detectors on its traffic.

Last updated 2026-11-09

Start free Read the Windsurf security guide

Windsurf works with Supabase when you connect it yourself.

What are the Supabase security risks in Windsurf apps?

An unscoped Supabase entry in Windsurf's MCP config
Windsurf adds MCP servers from its Customize > MCPs page or from .devin/mcp_config.json, and Supabase's MCP guide lists it as a client with OAuth. An entry without project scoping or read-only mode gives a prompt-injected instruction more reach than the task needs. Supabase advises one project, read-only mode, and production only when required.
New public tables that anyone can query
Windsurf documents no built-in RLS generation or Supabase scan. Tables its agent creates with SQL start with RLS off. On existing Supabase projects, new public tables also grant anon, authenticated and service_role full privileges, so the table is open through the API until you enable RLS.
A stronger key used to make a failing query pass
A query that fails under RLS can tempt a quick fix with a stronger key. A sb_secret_ key maps to service_role and skips RLS, so in an EXPO_PUBLIC_ or VITE_ variable it hands every user full access. Supabase is deprecating the legacy service_role JWT key by the end of 2026, so check for both key formats.
Security definer functions in the public schema
If Windsurf's agent writes a security definer function to get around a policy, the function runs as its owner and skips RLS for every caller who can execute it. Security Advisor lints 0028 and 0029 flag these functions. Move them to a private schema and grant execute only where needed.

How does Supahound protect your Windsurf app?

The free posture scan checks RLS coverage on every connected project and lists newly exposed tables, so a Windsurf migration that left RLS off appears in the next daily scan.
Security Advisor findings, including the security definer lints, appear in the same scan.
The service-key detector alerts from day one when a secret key is used from a browser or from a network the project has not seen.
The cross-tenant read detector flags a signed-in user reading rows that belong to other users or tenants, which is what a too-broad policy looks like in traffic.
Supahound reads the Supabase project, not the editor, so monitoring keeps working if you switch from Windsurf to another tool.

Frequently asked questions

Does Windsurf have a built-in Supabase integration?: Not a built-in one. You add Supabase's hosted MCP server at https://mcp.supabase.com/mcp from the Customize > MCPs page or in .devin/mcp_config.json, and sign in with OAuth. The agent then works with whatever Supabase code your repository has.
Why do Windsurf's docs open on docs.devin.ai?: docs.windsurf.com now redirects to docs.devin.ai/desktop, where Cognition documents the editor under the Devin Desktop name. The MCP setup that Supabase's guide refers to is described there.
Which Supahound alerts start as soon as I connect?: Cross-tenant reads, service-key misuse, credential stuffing and database tampering alert from day one. Behavioral detectors such as scraping learn your traffic for 7 days before they alert.

Watch your Windsurf app's Supabase traffic

Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.

Start free See pricing

Sources

Checked on 2026-11-09. Products change; check each source for current details.