.cursorignore not being used

General
1

I’ve set up my .cursorignore file to include the .env file where my secrets are stored, but it seems like they’re still being passed in the chat

image
image1434×892 229 KB

Some text was selected in the .env file, but in my understanding, the .cursorignore file should still be respected. Anything I’m doing wrong here?

4 Likes
2

Hi @xoel ,

Out of interest, did you have the .env file open and ‘in focus’ when you started the chat?

In Cursor Settings > Features > Chat there is a setting named:

  • Default no context (Submit chat with no context by default)

When that is toggled ON, chat does not select the open/focused file by default.

When it is toggled OFF, chat does select the open/focused file by default.

It displays Will Use: Current file in relation to the ‘open and focused’ file.

I was able to replicate the first part of what you saw, ie:

  • Default no context is OFF
  • The open and focused file is .env
  • I can see it says Will Use .env Current File

But I haven’t started a chat with it in those conditions.

Would be interesting to know what the expected behaviour is in the scenario when a file is ignored (via .cursorignore or .gitignore), but it is also open and focused when starting a chat and default no context is turned off.

It would also be interesting to know what the expected behaviour is if you @ an ignored file in a chat - I can see that .env shows in the @ dropdown, but I haven’t tested what happens if you actually choose it. (I don’t really want to do that :slight_smile: ).

Also, I am assuming you don’t have a .gitignore file, that’s why you added the .env entry to the .cursorignore file? I am pretty sure Cursor respects the .gitignore file first, and the .cursorignore file is in addition to what is ignored by the .gitignore.

1 Like
3

I have been experimenting with this as well. I mentioned in the slowing down chat that it is crucial to have this set up perfectly for Cursor to do it’s thing the fastest and smoothest way possible. In the next week or so I am going to take Cursor apart and take a look and see if there is anything i can do to speed it up, but it would be great to have some optimal build in functions schemas that make Cursor really fly right out of the box for new users.

4

Hi there,

I had both .gitignore and .cursorignore, the .env was focused and I had Default no context set to OFF

5

I also added my .env files to the .cursorignore file, but still, when I edit a .env file cursor still does auto completion suggestions. This let’s me believe it has access to this file. How can I exclude file for any operation in cursor as if the file would not exist? This is crucial to me, as some files might contain secrets that should never leave my machine.

3 Likes
6

This is a potentially serious security issue. We need an answer from Cursor on this. It should be possible to fully exclude files from indexing and auto-complete suggestions from Cursor Tab.

2 Likes
7

Hi, I have the same issue. I’m currently typing in Cursor in an Untitled file, and Tab keeps on trying to autocomplete my text.

Here’s the scenarios I want to prevent:

  • opening up a quick Untitled file, adding a secret key (without saving), and Cursor sending that to context
  • opening up an .env file (like the example above), and even though it’s .cursorignored, sending it to context (including sensitive data)
  • writing sensitive notes in a text file that I don’t want to be shared with AI.

Here’s the behavior I would like to see:

  • .cursorignore should not index any files in it
  • .cursorignore should block files from being used in context, including and ESPECIALLY open files, like the .env file example above. This applies to Chat, Cursor Tab, and inline suggestions.
  • It should be possible to get a concrete list of files covered by .cursorignore, so you can be sure that you don’t have a typo in .cursorignore.
  • There needs to be a way to block Cursor from sending ‘Untitled’ files to context.
  • Cursor default should to be block .env, .log, .txt etc. This should be overridable of course.
  • There should be a clear indicator in the UI that this file is or is not available to be put in context (in the status bar, not in the Chat window). VSCode does this with Copilot.
  • Ideally the above rules can be one-time overridden in the UI, at the user’s request.

The setting ‘cursor.chat.defaultNoContext’ is too blunt of an instrument. I want the open file to be sent as context, most of the time. I don’t want sensitive information to be shared with the AI.

The above issues are preventing me from switching fully to Cursor for all my development tasks (and I’d like to! :slight_smile: )

1 Like
8

I’d like to see someone from Cursor addressing @rubycon 's message, it’s very clear and addressing a very concerning issue.

9

Hey, I understand you want to make sure your confidential files don’t end up in the context or codebase. We might fix this in the future, but for now, you can use a native workaround by hiding your files with this rule:

"files.exclude": { "**/.env": true }

Also, if you want to stop code autocomplete in an untitled file, like when I create a file and add API keys, you can block Cursor Tab in these files with this rule in the settings:

"cursor.cpp.disabledLanguages": ["untitled"]

1 Like
10

@deanrie thanks for the quick reply.

"cursor.cpp.disabledLanguages": ["untitled"] is helpful, now those are not indexed any longer.

But the .env files still are, even after using files.exclude. I also added env* to disabledLanguages, with no luck.

BTW, files.exclude is not an option, as one needs to have access to them at hand. Requiring uses to use the OS’ file explorer is totally against what one would expect a code assistant company to stands for, efficiency and productivity.

I’m really concerned when I read “We might fix this in the future” when referring to indexing sending to the cloud one’s confidential files.

We’re doing a trial of Cursor and will need to reconsider it until this is addressed properly.

1 Like
11

I get your concern. Everything in your .gitignore and .cursoreignore files isn’t indexed in the codebase.

12

@deanrie even though I have .env* on .cursorignore, those are still autocompleted, which means they’re being somehow processed/indexed, right? (I just tested turning off internet connection, and I confirm autocomplete only worked with the internet on - even those on .cursorignore)

If you could check @rubycon 's message here, they did a good job in pointing out what would be ideal from a data security perspective.

2 Likes
13

Cursor doesn’t un-index files that you add to .gitignore or .cursorignore. It will continue to use secrets from those files until you restart. This is unexpected behavior and almost caused me to commit a secret value that Cursor auto-completed into a file.

14

We do not index files that are gitignored or cursorignored. This is respected on the next re-index (which happens about every 10 minutes or upon restarting the editor)

Cursor Tab is separate from indexing and will run on any open file unless you have cpp disabled on the file’s language.

cursorignore was primarily build for the indexing feature for codebase-chat. I don’t want to index lots of large/unneeded files (like my node modules or generated protobuf files) in a large codebase. But, I’d still like autocomplete to be able to read from/write to many of them. Cursor Tab does not persist code or code-derived information, which is why we worry less about the storage overhead/privacy when reading these files vs indexing.

But, I still think it is important to be able to specify files that Cursor Tab should never see, so we will work on a solution for this.

2 Likes