A note on naming
Documented behaviour side by side
| Aspect | Cursor | Windsurf (documented as Devin Desktop) |
|---|---|---|
| Training on your code | With Privacy Mode on, Cursor states it will not train on your data and has zero data retention agreements with model providers. With it off, the data use page says code and prompts may be stored and used to improve features and train models. | We could not verify an editor-specific statement on the pages we fetched. Confirm in the vendor's current documentation. |
| Terminal commands run by the agent | The docs say terminal commands need your approval by default, and that Run Modes range from an allowlist to an automatic review classifier. | Four levels are documented: Disabled, Allowlist Only, Auto and Turbo. In Turbo, all commands run immediately except those on your deny list. |
| Allow and deny lists | An allowlist is available. Cursor describes these guardrails as best effort and not a hard security boundary. | Allow and deny lists are documented. A command that matches both lists requires approval. |
| File edits | The docs say agents can modify workspace files without approval, except configuration files. | Confirm in the vendor's current documentation. |
| Ignore files | .cursorignore blocks listed files from Agent, Tab, Inline Edit and @ mentions. The docs say terminal and MCP tools cannot be blocked this way and complete protection is not guaranteed. | An ignore file (.devinignore, with .codeiumignore and .windsurfignore also respected) excludes paths from indexing. Paths in gitignore, node_modules and hidden paths are ignored by default. |
| MCP servers | The docs say every MCP connection needs approval, and each tool call needs approval unless you pre-approve it. | Servers are added from a marketplace or by editing mcp_config.json. The docs note that tool calls can invoke code written by arbitrary server authors. Team admins can allowlist servers. |
| Team controls | Confirm the current admin controls in the vendor's documentation. | Admins on Teams and Enterprise can set a maximum auto-execution level and team-wide command lists. |
| Attestations | Cursor's security page lists a SOC 2 Type II attestation and ISO/IEC 27001:2022 certification, with documents available through its trust centre. | Confirm the current attestations for the editor in the vendor's documentation. |
What Cursor leaves to you
- Turning Privacy Mode on if you do not want code stored or used for training, and checking the setting on every machine and account.
- Choosing a Run Mode. Anything beyond manual approval means the agent can run commands you have not read.
- Keeping real secrets out of the workspace. Cursor's docs say .cursorignore is not a guarantee and does not cover terminal or MCP tools.
- Deciding which MCP servers to connect and which tools to pre-approve.
What Windsurf leaves to you
- Picking the auto-execution level. Turbo runs everything not on your deny list, so the deny list becomes the only brake.
- Maintaining the allow and deny lists, and remembering that a prefix such as git allows every git subcommand.
- Vetting MCP servers before you add them, since the docs say tool calls can run code written by arbitrary server authors.
- Confirming data retention and training settings for your plan in the vendor's current documentation.
What to check whichever you pick
- Agent terminal commands require approval, or the allowlist contains only read-only commands.
- No production credentials live in the repository folder or in shell environment variables the agent's terminal inherits.
- Privacy and data retention settings match what your customers and contracts require.
- Every MCP server you connected is one you chose on purpose, from a source you trust.
- You read agent diffs before committing, especially changes to auth, access rules, CI files and dependencies.
- Secret scanning runs on the repository so a key pasted by an agent is caught before it is pushed.
Frequently asked questions
Is Cursor or Windsurf safer for private code?
It depends on your settings and plan. Cursor documents a Privacy Mode under which it says it does not train on your data. For Windsurf, confirm the data retention and training terms for your plan in the vendor's current documentation.
Does .cursorignore stop the AI reading my .env file?
Cursor's docs say it blocks listed files from Agent, Tab, Inline Edit and @ mentions, but that terminal and MCP tools cannot be blocked this way and complete protection is not guaranteed. Keep production secrets out of the workspace.
What does Turbo mode do in Windsurf?
The documentation says all agent terminal commands are auto-executed immediately, except those on your deny list. Team admins can cap the maximum level for their organisation.
Can an AI code editor run commands without asking me?
Only if you allow it. Cursor's docs say commands need approval by default, and the Windsurf documentation describes a Disabled level where every command needs manual approval. Both also offer modes that run commands automatically.