What are common vulnerabilities in Windsurf-generated code?

The most common vulnerabilities in Windsurf-generated code include missing input validation on API endpoints, SQL injection through string concatenation, cross-site scripting via unsanitized output, and insecure direct object references where user IDs are not verified against the authenticated session. Generated authentication code may use weak password hashing, predictable session tokens, or missing CSRF protection. Dependency suggestions often include packages with known CVEs, and error handlers frequently leak internal system information. These patterns mirror vulnerabilities commonly found in the open-source code that AI models are trained on. UNPWNED scans for all of these vulnerability categories and provides specific fix recommendations for each finding.