What are common vulnerabilities in Windsurf-generated code?

The most common vulnerabilities in Windsurf-generated code include missing input validation on API endpoints, SQL injection through string concatenation, cross-site scripting via unsanitized output, and insecure direct object references where user IDs are not verified against the authenticated session. Generated authentication code may use weak password hashing, predictable session tokens, or missing CSRF protection. Dependency suggestions often include packages with known CVEs, and error handlers frequently leak internal system information. These patterns mirror vulnerabilities commonly found in the open-source code that AI models are trained on. UNPWNED checks externally observable exposure, configuration, dependency, endpoint, and error-disclosure signals. Paid reports provide remediation guidance for each completed finding; internal code paths still require code review. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.