.cursorignore ignored for command prompt functions

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Love the product, but it’s definitely a bug when the AI blatantly asks you to run commands like “echo .env” when it sees .env is in .cursorignore. It even tells you it does so specifically to circumvent the .cursorignore.

This should not be the case, even if it asks you explicitly when you’ve not whitelisted the command. The .cursorignore file exists for a reason, which is to protect your sensitive files from the world. Users should be protected from this in a hard-coded and non-circumventable way, so that the IDE can be used securely.

Steps to Reproduce

Put a file in .cursorignore and try to write a script that uses it.

Expected Behavior

Everything in .cursorignore should be treated as non-existent and should be prevented from being printed.

Operating System

Windows 10/11

Current Cursor Version (Menu → About Cursor → Copy)

Version: 2.3.29 (user setup)
VSCode Version: 1.105.1
Commit: 4ca9b38c6c97d4243bf0c61e51426667cb964bd0
Date: 2026-01-08T00:34:49.798Z
Electron: 37.7.0
Chromium: 138.0.7204.251
Node.js: 22.20.0
V8: 13.8.258.32-electron.0
OS: Windows_NT x64 10.0.26200

For AI issues: which model did you use?

Sonnet 4.5 and Opus 4.5

Does this stop you from using Cursor

No - Cursor works, but with this issue

3

Hey, thanks for the detailed report.

This is a known limitation. .cursorignore blocks access for Tab, Agent, Inline Edit, and @ mentions, but it can’t block terminal commands. This is stated directly in the docs:

“The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore”

Recommendations to protect sensitive data:

  1. Don’t add commands like cat, head, sed, echo, Get-Content to the allowlist for projects with sensitive data
  2. Keep “Ask Every Time” enabled so every terminal command requires your approval
  3. Use the Agent Tools settings to control this: https://cursor.com/docs/agent/tools

Relevant docs:

The ideal behavior is that the LLM shouldn’t even try to read ignored files via the terminal. I’ll pass this along as feedback to the team.

4

Thank you for pointing me to the docs and forwarding it to the team. I don’t add commands to the allowlist by default, but that’s just me.

My guess is that this is something that should be managed in the system prompt/context or manually filtered out as a security by design feature.

Cheers.

1 Like
5

This topic was automatically closed 22 days after the last reply. New replies are no longer allowed.