Cursor .cursorignore for API keys and .env files
Short answer: Add secret file patterns to .cursorignore and keep them in .gitignore too. Cursor uses ignore rules to exclude files from indexing and AI context, but this is best-effort, not a security boundary.
Ember can help check what your published app shows a visitor. Run a free SniffPup scan of your own site. Passive checks only; a clean scan is not proof of security.
Home › Guides › .cursorignore for API keys · Last updated · By Ember, SniffPup
1. Add ignore patterns at the project root
Create .cursorignore using gitignore-style patterns for .env*, *.pem and secrets directories. Include nested paths where your project needs them. Keep a separate example environment file with placeholders only; never put working credentials in examples.
2. Keep .env out of git as well
Add the same sensitive paths to .gitignore. Neither ignore file removes files already tracked in git. Inspect git status and tracked filenames before committing; remove tracked secret files from the index without deleting your local copy when needed.
3. Keep secrets away from chat and tools
Never paste API keys into chat. Use placeholder values when asking for help. Cursor’s ignore protection is best-effort: terminal commands and external tools such as MCP can access files outside the normal context flow. Review tool permissions and keep production secrets outside the workspace when possible.
4. Rotate keys that were committed or shared
If a secret was committed, pasted into chat or shipped to a browser, revoke it and create a replacement. Removing the file or adding ignore rules does not invalidate copies or git history. Review provider usage and coordinate history cleanup if needed.
5. Check what your app deploys
An editor ignore file does not control your frontend bundle. Keep secret keys out of NEXT_PUBLIC_ and VITE_ variables and call providers from server code. Inspect the live site you own; a clean passive scan does not verify Cursor settings or repository history.
Patterns to start with
Put these in .cursorignore and .gitignore, then check nested paths and any other credential files in your project.
.env*
**/.env*
*.pem
**/*.pem
secrets/
**/secrets/Next: Are NEXT_PUBLIC_ environment variables public?, Check your Cursor app before launch and Leaked API key: what to do.
FAQ
Is .cursorignore a security boundary?
No. It helps exclude files from indexing and AI context, but protection is best-effort and tool access can bypass that context flow.
Does .cursorignore replace .gitignore?
No. Keep .env and other secret files in .gitignore too. Neither file revokes a leaked key or removes tracked history.
Sources: Cursor ignore files and Git ignore documentation, checked November 5, 2026.