Devin Desktop Security Basics

Overview

Devin Desktop is the current name for Windsurf. Secure it with layered controls: repository permissions and secret management are authoritative; .codeiumignore, Rules, and prompts reduce context exposure but do not replace access control.

Prerequisites

• A version-controlled workspace and clean working tree
• The organization's data-classification and secret-handling policy
• Authorization to inspect configuration without collecting secret values

Tool Use

• Use Read to inspect only the repository files and configuration needed for the request.
• Use Grep to locate relevant settings, rules, logs, or code without broad collection.
• Use Write only for a new artifact the user requested; never write credentials or unreviewed production configuration.

Instructions