Ship guide
Ship a Windsurf app
Windsurf is an editor plus agents, including cloud agents that run on their own machine. Treat a cloud run like a teammate with a branch. Treat MCP servers you enabled like extra permissions.
Updated 16 Oct 2026 · Directory entry
A checklist for this builder, not a promise the app is production-safe. Confirm every setting in the project you actually generated.
01
See which agent ran and what it could touch
Local Cascade sees the workspace. A cloud agent may see a remote checkout and any MCP tool you turned on. Disable MCP servers the task does not need before you call the run done.
02
Review the branch
Read the diff, including tests the agent skipped. Add Socket or dependency scanning if it installed packages. Do not merge a green UI with an unread lockfile.
03
Search the branch for secrets
Use the API key checklist. Cloud agents that were given a .env to “make tests pass” may have copied values into source.
04
Confirm the deploy target and the data rules
Hosting is separate. So is the database. Supabase projects still need the RLS checklist. Preview environments need protection if they hold real rows.
05
Add limits and monitoring
Rate limiting on routes that spend money, error monitoring from the monitoring category, and the pre-launch checklist on the URL you will share.