Windsurf
security
Windsurf Generated Code Using eval() or Function Constructor
Windsurf's Cascade assistant generated JavaScript or TypeScript code that uses eval(), new Function(), or setTimeout/setInterval with string arguments to dynamically execute code. These patterns create severe code injection vulnerabilities that allow attackers to run arbitrary code in your application.
This typically happens when Cascade generates code to parse user input, build dynamic queries, process configuration files, or create flexible template systems. The generated code works correctly but introduces a critical attack surface.
You might discover this during a security audit, when a linter flags eval usage, or when a code review catches the pattern. If deployed to production, any user-controlled input reaching these eval calls could be exploited.
Error Messages You Might See
EvalError: Refused to evaluate a string as JavaScript
Content Security Policy directive: script-src 'self' does not allow 'unsafe-eval'
ESLint: eval can be harmful (no-eval)
TypeError: eval is not a function in strict mode
Common Causes
- Dynamic JSON parsing with eval — Cascade used eval() to parse JSON instead of JSON.parse(), often when handling API responses with complex structures
- String-based computed properties — Generated code uses eval to dynamically access nested object properties instead of bracket notation or lodash.get
- Template string execution — Cascade built a template engine using new Function() to interpolate variables into strings
- Dynamic import construction — Code constructs module import paths using eval rather than dynamic import() expressions
- Math expression evaluation — A calculator or formula feature uses eval() to compute user-entered expressions
How to Fix It
- Search your codebase for eval patterns — Run grep -rn 'eval\|new Function\|setTimeout.*"\|setInterval.*"' src/ to find all instances
- Replace eval(JSON) with JSON.parse() — Every eval() call parsing JSON can be safely replaced with JSON.parse() wrapped in try-catch
- Use bracket notation for dynamic properties — Replace eval('obj.' + path) with a safe property accessor function that splits the path and walks the object
- Install a math expression parser — Replace eval() for math with a safe library like mathjs or expr-eval that only allows mathematical operations
- Add ESLint no-eval rule — Add 'no-eval': 'error' and 'no-new-func': 'error' to your ESLint config to prevent future occurrences
- Implement Content-Security-Policy — Add a CSP header with script-src that excludes 'unsafe-eval' to block eval at the browser level
Real developers can help you.
Caio Rodrigues
I'm a full-stack developer focused on building practical and scalable web applications. My main experience is with **React, TypeScript, and modern frontend architectures**, where I prioritize clean code, component reusability, and maintainable project structures.
I have strong experience working with **dynamic forms, state management (Redux / React Hook Form), and complex data-driven interfaces**. I enjoy solving real-world problems by turning ideas into reliable software that companies can actually use in their daily operations.
Beyond coding, I care about **software quality and architecture**, following best practices for componentization, code organization, and performance optimization.
I'm also comfortable working across the stack when needed, integrating APIs, handling business logic, and helping transform prototypes into production-ready systems.
My goal is always to deliver solutions that are **simple, efficient, and genuinely useful for the people using them.**
Krishna Sai Kuncha
Experienced Professional Full stack Developer with 8+ years of experience across react, python, js, ts, golang and react-native. Developed inhouse websearch tooling for AI before websearch was solved : )
AUXLE
I am a Full Stack Developer experienced in building Websites, Web apps and Cross Platform Mobile Apps for Startups and Companies.
Prakash Prajapati
I’m a Senior Python Developer specializing in building secure, scalable, and highly available systems. I work primarily with Python, Django, FastAPI, Docker, PostgreSQL, and modern AI tooling such as PydanticAI, focusing on clean architecture, strong design principles, and reliable DevOps practices. I enjoy solving complex engineering problems and designing systems that are maintainable, resilient, and built to scale.
Taufan
I’m a product-focused engineer and tech leader who builds scalable systems and turns ideas into production-ready platforms.
Over the past years, I’ve worked across startups and fast-moving teams, leading backend architecture, improving system reliability, and shipping products used by thousands of users. My strength is not just writing code — but connecting product vision, technical execution, and business impact.
zipking
I am a technologist and product builder dedicated to creating high-impact solutions at the intersection of AI and specialized markets. Currently, I am focused on PropScan (EstateGuard), an AI-driven SaaS platform tailored for the Japanese real estate industry, and exploring the potential of Archify.
As an INFJ-T, I approach development with a "systems-thinking" mindset—balancing technical precision with a deep understanding of user needs. I particularly enjoy the challenge of architecting Vertical AI SaaS and optimizing Small Language Models (SLMs) to solve specific, real-world business problems. Whether I'm in a CTO-level leadership role or hands-on with the code, I thrive on building tools that turn complex data into actionable value.
Jacek Rozanski
Senior PHP/Symfony developer and DevOps engineer with 20+ years of professional experience, running opcode.pl (web development agency, est. 2004).
Day job: I'm the sole backend developer at merketing company where I own and maintain 11 PHP/Symfony microservices on AWS (ECS Fargate, RDS, S3, CloudFront), handle the full CI/CD pipeline (Bitbucket Pipelines, Docker), and manage monitoring with Sentry and CloudWatch. These services handle high request volumes in production every month.
What I bring to AI-built apps:
- I audit and fix security issues (OWASP methodology), performance bottlenecks, and architectural problems in codebases generated by Cursor, Claude Code, Lovable, Bolt, and v0
- I refactor AI-generated prototypes into production-grade applications with proper error handling, testing, and clean architecture (SOLID, DDD, hexagonal architecture)
- I set up the infrastructure AI tools don't touch: AWS hosting, CI/CD pipelines, automated deployments, database optimization, monitoring, and alerting
- I integrate external services: payment providers, email systems, partner APIs, SSO/auth
Tech stack: PHP 8.x, Symfony, React, Next.js, PostgreSQL, MySQL, Docker, AWS (ECS, RDS, S3, SQS/SNS, CloudFront), Terraform, Supabase. I also use AI tools daily (Claude Code, Cursor) in my own workflow, so I understand both the strengths and the gaps in AI-generated code.
Based in Poland (CET timezone). Available for async work and calls during EU/US business hours.
Victor Denisov
Developer
Matt Butler
Software Engineer @ AWS
Jaime Orts-Caroff
I'm a Senior Android developer, open to work in various fields
You don't need to be technical. Just describe what's wrong and a verified developer will handle the rest.
Get HelpFrequently Asked Questions
Why is eval() dangerous even if it works correctly?
eval() executes any string as code. If an attacker can influence the string (through URL parameters, form inputs, database values), they can run arbitrary JavaScript — stealing cookies, accessing APIs, or modifying your page.
Is JSON.parse() always a safe replacement for eval()?
For parsing JSON data, yes. JSON.parse() only parses valid JSON and cannot execute code. Wrap it in try-catch to handle malformed input gracefully.