# Autocomplete in .env file

**URL:** <https://forum.cursor.com/t/autocomplete-in-env-file/150431>\
**Category:** Bug Reports\
**Tags:** tab, security\
**Created:** [January 31, 2026, 12:25am UTC](https://forum.cursor.com/t/autocomplete-in-env-file/150431 "2026-01-31T00:25:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Meredith\_Lampe](https://avatars.discourse-cdn.com/v4/letter/m/f475e1/32.png) [@Meredith\_Lampe](https://forum.cursor.com/u/Meredith_Lampe)\
**Post date:** [January 31, 2026, 12:25am UTC](https://forum.cursor.com/t/autocomplete-in-env-file/150431/1 "2026-01-31T00:25:26Z")

</div>

### Where does the bug appear (feature/product)?

Cursor IDE

### Describe the Bug

I’m seeing cursor attempt to autocomplete in my .env file, including usernames and tokens, and this seems like a security issue.

### Steps to Reproduce

Open env file with some next/sanity ENV var template like this:

# Defaults, used by ./intro-template and can be deleted if the component is removed

NEXT\_PUBLIC\_VERCEL\_GIT\_REPO\_OWNER=“sanity-io”  
NEXT\_PUBLIC\_VERCEL\_GIT\_PROVIDER=“github”  
NEXT\_PUBLIC\_VERCEL\_GIT\_REPO\_SLUG=“nextjs-personal-website-cms-sanity-v3”

# Required, find them on [https://manage.sanity.io](https://manage.sanity.io)

NEXT\_PUBLIC\_SANITY\_PROJECT\_ID=  
NEXT\_PUBLIC\_SANITY\_DATASET=  
SANITY\_API\_READ\_TOKEN=

# Optional, useful if you plan to add API functions that can write to your dataset your dataset

SANITY\_API\_WRITE\_TOKEN=

# Optional, can be used to change the Studio title in the navbar and differentiate between production and staging environments for your editors

NEXT\_PUBLIC\_SANITY\_PROJECT\_TITLE=“Next.js Personal Website with [Sanity.io](http://Sanity.io)”

see that cursor attempts to tab complete repo owner, sanity API read token, etc.

### Expected Behavior

Cursor does not tab complete environment variables

### Screenshots / Screen Recordings

![Screenshot 2026-01-30 at 7.17.54 PM.png](https://us1.discourse-cdn.com/cursor1/optimized/3X/e/e/ee325475384d503b898b0d227a036844faa7bfd8_2_690x43.png)

### Operating System

MacOS

### Version Information

IDE Version: 2.4.21

### For AI issues: which model did you use?

I have Opus 4.5 selected in chat, not sure if this is being used for autocomplete

### Does this stop you from using Cursor

No - Cursor works, but with this issue

---

<div class="post-metadata">

**Author:** ![Colin](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/colin/32/90452_2.png) [@Colin](https://forum.cursor.com/u/Colin)\
**Post date:** [January 31, 2026, 9:23am UTC](https://forum.cursor.com/t/autocomplete-in-env-file/150431/3 "2026-01-31T09:23:35Z")

</div>

Hey @Meredith_Lampe!

You should be able to configure `.env` to be ignored by [adding a `.cursorignore` to your project](https://cursor.com/docs/context/ignore-files#configuring-cursorignore).

The docs reference a global cursorignore file – there have been some changes around this in the latest release (not yet reflected in the docs) that I’m following up on.

---

<div class="post-metadata">

**Author:** ![kostyamospan](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/kostyamospan/32/98423_2.png) [@kostyamospan](https://forum.cursor.com/u/kostyamospan)\
**Post date:** [February 16, 2026, 10:50am UTC](https://forum.cursor.com/t/autocomplete-in-env-file/150431/4 "2026-02-16T10:50:08Z")

</div>

Don’t you think that introducing breaking changes without backward compatibility — and without notifying users or updating the documentation — isn’t a great practice?

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\
**Post date:** [March 10, 2026, 10:50am UTC](https://forum.cursor.com/t/autocomplete-in-env-file/150431/7 "2026-03-10T10:50:26Z")

</div>

Closed on March 10, 2026, 10:50am UTC

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.