Devin Desktop (formerly Windsurf)
Cognition's agent-centric IDE, renamed from Windsurf, that pairs a local agent with cloud agents, a CLI, and code review under the Devin brand.
Tiered subscriptions with a free tier plus individual, team, and enterprise levels, metered by usage; enterprise contracts are billed in vendor-defined agent compute units.
Proprietary
Appears in 1 guide
Where it ranks
Guides that include Devin Desktop (formerly Windsurf).
Security headers
What Devin Desktop (formerly Windsurf)'s website sends to your browser.
Scanned 2026-08-25. Grade headers F, scoring 5 out of 100.
−
No Content-Security-Policy, so no defence in depth against cross-site scripting
−
No Strict-Transport-Security, so browsers may still attempt plain HTTP
−
No X-Content-Type-Options, so MIME sniffing is not disabled
−
No X-Frame-Options and no CSP frame-ancestors, so clickjacking is possible
−
No Referrer-Policy, so full URLs may leak to third parties
−
No Permissions-Policy, so powerful browser features are not restricted
−
No Cross-Origin-Opener-Policy
−
No Cross-Origin-Resource-Policy
+
No server-version or X-Powered-By disclosure
This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.