How should I review Windsurf code for security?

Review all database queries for parameterized input handling, check authentication and authorization on every route, and verify that user input is validated on the server side. Look for hardcoded credentials, API keys, or secrets that Windsurf may have included based on patterns in its training data. Examine error handling to ensure stack traces and internal details are not exposed to end users. Verify that any cryptographic operations use established libraries with secure defaults rather than custom implementations. UNPWNED complements manual code review by scanning the deployed application externally, catching runtime vulnerabilities that static code analysis may miss.