# CMD+L "generate PROJECT.md"

**URL:** <https://forum.cursor.com/t/cmd-l-generate-project-md/62219>\
**Category:** Help\
**Created:** [March 11, 2025, 3:09am UTC](https://forum.cursor.com/t/cmd-l-generate-project-md/62219 "2025-03-11T03:09:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rumblelab](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/rumblelab/32/35105_2.png) [@rumblelab](https://forum.cursor.com/u/rumblelab)\
**Post date:** [March 11, 2025, 3:09am UTC](https://forum.cursor.com/t/cmd-l-generate-project-md/62219/1 "2025-03-11T03:09:09Z")

</div>

To reproduce the “bug”, you open a new cursor window, and open an old project. You ask it to read the files and generate a PROJECT.md, so you can set the vibes to 9000.

You realize you just fed your .env to the agent.

I guess my question is, where did it go? How quickly can you re-secure all your environment variables? Would fly.pieter’s .env be baked into weights? Could a well engineered prompt release some sensitive info?

I asked claude about it, he said I should reach out.

> **[Claude](https://claude.ai/share/cf3c7185-00d2-4dee-9e94-c2f7ab41e6b7)**
>
> Talk with Claude, an AI assistant from Anthropic

OH, this happens on macOS. Assumably, it happens everywhere in cursor.

I might just think twice about my cursor pro account. Still works though.

---

<div class="post-metadata">

**Author:** ![system](https://sea3.discourse-cdn.com/cursor1/user_avatar/forum.cursor.com/system/32/99069_2.png) [@system](https://forum.cursor.com/u/system)\
**Post date:** [April 10, 2025, 3:09am UTC](https://forum.cursor.com/t/cmd-l-generate-project-md/62219/2 "2025-04-10T03:09:35Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.