Can Windsurf generate code with SQL injection flaws?

Windsurf can generate database queries that concatenate user input directly into SQL strings rather than using parameterized queries or prepared statements. This pattern is common in training data from open-source projects and tutorials that prioritize simplicity over security. AI code generators including Windsurf often produce string interpolation patterns like template literals in SQL queries when the prompt does not explicitly request parameterized queries. Even when using ORMs, Windsurf may generate raw query calls that bypass the ORM safety features. Review database queries with code review or SAST. UNPWNED still checks externally observable configuration, exposure, dependency, and error-disclosure signals. SQL-injection, reflected-XSS, and path-traversal probes are not enabled in the current production profile.