At day job while someone was trying out windsurf, it simply picked up an environment variable that contained sensitive data and used it in code. This is wild.