.cursorignore does not keep a secret from the agent

Symptom

A .env file is listed in .cursorignore, and the agent still reads it through the terminal or an MCP tool.

Root cause

Cursor's ignore-file doc says .cursorignore blocks files from Agent, Tab, Inline Edit, and @ mentions. The same page says the terminal and MCP server tools used by Agent cannot block access to that code. It also says complete protection is not guaranteed because of LLM unpredictability. .env* is on Cursor's default ignore list, which keeps those files out of indexing, and that is not the same as keeping them out of a shell command. The documented security step is still to ignore env files, credentials, and keys, and to keep real secrets out of the repo.

In this repository only:

1. Add a .cursorignore at the root if it is missing. Include **/.env, **/.env.*, **/credentials.json, **/secrets.json, **/*.key, and **/*.pem.
2. Confirm .env files are gitignored and are not in git history you are about to publish. Do not commit them to un-ignore them.
3. Do not print secret files from the terminal. If a secret was shown in the chat, rotate it.
4. Read secrets from the environment or from Cursor Secrets for cloud agents, not from a committed env file.

Do not cat .env to prove the ignore file works.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own repo, confirm .env is matched by .gitignore and by .cursorignore or Cursor's default ignore list.
2. Run git status and confirm no env file is staged.
3. If a chat transcript shows a secret value, rotate that credential. Do not test the boundary by asking the agent to print the file.

Sources

• Cursor: Ignore file