Cursor reads .env even though it is on .cursorignore

[xyzatin]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I asked about a bug, and it went absolutely crazy - digging deep like a mad detective tossing files around looking for clues haha. During that process, it noticed I was missing some variables in my .env.local file, so it checked my .env file to confirm everything was there. Later, I found out the real issue was that my Supabase service was paused. Unfortunately, I do not have chat/screenshot since I undo that chat because it was not useful. Also, I mentioned “.env” in my .cursorignore file.

Steps to Reproduce

I can’t say about this much but I feel like when there is no hope or understanding of the solution occur/kinda desparation(my guess) then it goes to .env file.

Expected Behavior

Reading “.env” environment file, its variables.

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.7.40
VSCode Version: 1.99.3
Commit: df79b2380cd32922cad03529b0dc0c946c311850
Date: 2025-10-09T02:55:11.735Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Darwin arm64 25.0.0

For AI issues: which model did you use?

claude-4-sonnet (Agent) with enabled “Auto-Run Mode”

Does this stop you from using Cursor

No - Cursor works, but with this issue

[deanrie]

Hey, thanks for the report. Unfortunately, this is a known limitation with Agent.

While .cursorignore blocks files from indexing and direct AI access, it can’t block Agent’s tool calls (like terminal commands such as grep or cat). This is documented in the ignore files docs.

Workarounds:

1. Use files.exclude in VS Code settings to hide .env entirely:

   {
       "files.exclude": {
           "**/.env": true
       }
   }

2. Monitor Agent’s terminal commands and stop it if it tries to access sensitive files
3. Store sensitive values outside the project directory when using Agent with Auto-Run Mode