Code review for code written with Windsurf and Devin Desktop
Windsurf became Devin Desktop in June 2026, and its local agent, Devin Local, took over from Cascade. It will install the package, write the feature, run the tests, fix the lint errors and ask if it looks good, all in one go. It is a very productive way to produce code nobody has read.
I read it. You get a ranked list of what to fix, in plain English, with a fix prompt for each finding you can paste back into Devin Local.
1Line 5: The rule was switched off to clear a warning, so switching customers in the sidebar keeps showing the first customer's invoices.
Common problems in Windsurf / Devin apps
Not every app has all of these. The report tells you which ones yours has, where, and what to do about each.
Critical
Ownership checks that stop at logged in
The handler confirms there is a session, then loads whatever record id the request names. Any customer can read any other customer's invoices by changing a number in the URL. I check every lookup for a where clause that includes the user.
High
Lint errors fixed by turning the rule off
When the agent runs the linter and a rule gets in the way, the shortest path to green is an eslint-disable comment or a change to the config. Rules like react-hooks/exhaustive-deps and no-floating-promises exist to catch real bugs. I list each suppression and what it hides.
High
Dependencies added one at a time, never removed
Every session that needed something ran an install. The result is two HTTP clients, three date libraries, abandoned packages and a lockfile nobody has audited. Each one is code that runs in your process. I list what to remove and flag the ones with known problems.
Medium
Work started and never awaited
Emails, webhooks and analytics calls fired without await inside route handlers and server actions. On a serverless platform the function can return before the work is done, and the failure goes nowhere. I find each one and say whether it needs an await or a queue.
Medium
Request bodies in the logs
console.log(req.body) added while debugging and left in. Passwords, tokens and card details end up in your logging provider for as long as it keeps them. The fix is logging that says what happened without saying what was sent.
Low
Three places that think they own the config
Defaults hard-coded in the code, a config.ts and an .env.example that disagree with each other. Production uses whichever one loads first. I say which one should win.
Treatment plan
How it works
1
Book a check-up
Choose a tier and tell me where to send the report. Add your app's address if it is live. Two minutes, no sales call.
2
Show me your code
Pay by card, then give me read-only access to your code on GitHub (you paste in a key I send you) and let me into your app with test accounts. Never done that? I send you step-by-step instructions for your tool. I measure your app and confirm it fits before I start.
3
Get your diagnosis
Ready to launch, or not yet. Problems ranked, critical ones proven on your live app, each with a prescription for your AI tool. A PDF by email, then 7 to 30 days of questions by email.
4
Fix it, then a free follow-up
Fix the problems yourself, with your AI, or let me do it with the Fix Pack. Tell me within 30 days and I check once more that they are really gone.
No idea how big your app is? That’s normal, and you never have to count anything. Book the review you want; I measure your app before I start and tell you. If it doesn’t fit, you choose: upgrade, narrow it down, or a full refund. “Lines of your code” means the code you and your AI wrote, not the packages and UI kit your tool installed; many apps built with Lovable, Bolt or v0 fit the Safety Scan.
Start small, upgrade later. The Safety Scan’s price counts in full toward a Launch Review or Fix Pack for the same app within 30 days of your report.
Why this price? Software does the first pass, so you pay for the part only a person can do: checking every finding in your code, proving the critical ones and deciding what matters for your app. I take at most 3 Safety Scans and 2 Launch Reviews (or one Fix Pack) a week; if this week is full, yours starts the next.
Prices in US dollars, paid once, no sales call and no surprise invoice: anything extra is your choice, told to you before I start. The clock starts when I can see your code. Reports arrive as a PDF by email, in English, or German if you prefer.
Need a few things fixed after a scan? I fix by the hour at $199, three hours minimum, with the list agreed before I start.
Bigger than 50k lines, or a real mess? Rescue jobs are quoted, from $3,000, no obligation. Email me.
Not for you if
you have a team of engineers who already review each other’s code,
your app’s backend isn’t JavaScript or TypeScript (Python Replit apps, for example), or it is over 100k lines,
you handle regulated data (health records, banking, children), or need a pentest, certificate or compliance sign-off. Taking card payments through Stripe is fine.
A review lowers your risk a lot. It can’t guarantee that your app is secure, and nobody honest will say otherwise.
Windsurf / Devin questions
How do I share code written in Windsurf or Devin Desktop?
Devin Desktop works on a normal local project, as Windsurf did. Push it to a GitHub repository (or GitLab or Bitbucket) and give me read-only access (I send you a key to paste in; it takes a minute).
Can I apply the fixes in Devin Desktop?
Yes. Each finding comes with a fix prompt written for an agent, naming the files and the change. Paste it into Devin Local, read the diff before accepting it, and run the tests yourself.
Will you tell me what to put in my rules file?
Yes. Devin Desktop reads rules from .devin/rules and still reads the older .windsurf/rules folder and .windsurfrules file. The report ends with a short list of rules for your project, so the next session does not reintroduce the same findings. Things like validating every request body with the shared schema, never disabling a lint rule without a comment saying why, and always including the user id in the where clause.
Why not just ask my AI to review it?
Do, and I will even give you the prompt. You will get a long list. What your AI cannot do is tell you which items are real, prove them against your live app, see your database and hosting settings, or check that its own fixes worked. If you cannot read code, that is the part you cannot do yourself either. It is what you pay me for.
I'm not a developer. Is this for me?
Yes, that is exactly who it is for. If you built an app with AI and cannot tell whether the code is any good, I check it and explain what matters in plain English. You never need to understand the code to act on the report: every problem comes with a prompt you paste into your AI tool. And you do not need to know what to ask. The report answers the questions you would have asked if you knew how.
How do I show you my code?
Most AI builders can push your app to GitHub, a free site that stores code. You give me read-only access by pasting a key I send you into your repository settings, which means I can look but not change anything. Never done it? After you book, I send you step-by-step instructions for your tool. A zip file works too. When the report is delivered, remove my access again; I remind you.
Is my code safe with you?
Every booking comes with an NDA, automatically. I never sell, publish or pass on your code. The only other party that sees it is the AI provider that helps with the first pass, under terms that do not allow it to train on your code. I never need your passwords or your live database, and I delete my copy within 7 days of delivering the final report.
From $149 for the first 10 customers (10 left). Ready within 2 business days. If the Safety Scan finds no problem rated medium or worse, you pay nothing.