Environment Secrets and Code Security

Bug Report
1

Hey wonderful guys at Cursor,
Congratulations on building such an amazing product.

I started using Cursor and I can’t take this thing out of mind about how my .env credentials and code is handled in API request.
Base Settings - File Indexation Allowed, privacy mode on, gitignore has .env listed.

Now in this scenario too, I am able to access the .env file in the chat. So logically this is also sent through your API.
Even though the code is not stored on your end, it is stored for 30 days on OpenAI and Claude.

So I feel this is a risk for anyone using it and just wanted more clarity on how a request goes through Cursor and how it works in this scenario. I also read that there is a base scrubber that does not send the .env secrets to the API as well so wanted more clarity on this.

I would ideally want how the request goes and stored on all participants in the flow so can be assured on my end to use it from now. Would really appreciate a detailed reply.

3 Likes
2

Can anyone from the cursor team please check this. Thanks

3

Good question, I had the same question, did you get an answer?

4

Nope still waiting for this

5

Hi @saucr7 and @DaveWang ,

Have you seen these resources:

https://docs.cursor.com/context/codebase-indexing

https://docs.cursor.com/context/ignore-files

https://docs.cursor.com/privacy/privacy

https://www.cursor.com/privacy

https://www.cursor.com/security

And a related post:

If you have a specific question that is not covered in these resources, please post back with more details about what you would like to know.

1 Like
6

@litecode Is there a way to completely ignore something like a .env file?

I noticed the same thing that @saucr7 did which concerned me as well. That even if the file is in my .gitignore I can still tag the file in the chat which presumably means if you tag an ignored file which has secrets by mistake it will get sent to Cursor’s servers as well as OpenAI/Anthropic’s

I mean “completely ignore” in the sense that I would not like it to ever be sent in any request or leave my local machine at all which would include not being able to tag the file in chat.

This might help prevent mistakes that would result exposing app secrets.

7

I think this should be fixed, thanks for the info.

8

Hi @jpiv ,

This is all the information that I am aware of on the topic of ignoring files:

https://docs.cursor.com/context/ignore-files

The concept of a .cursorban file is also mentioned on the security page at https://www.cursor.com/security.

For reference, prior to more recent developments, there was talk of ‘scrubbers’ that worked to prevent unintentional sharing of secrets etc:

So, for me, this communicates the Cursor devs are aware of the surrounding dynamics and creating solutions that will satisfy themselves and other end-users.

9

Thanks! I missed that part of the documentation. I will send an email like it recommends in the docs. Hopefully that feature will be added :slight_smile:

1 Like
10

Any update on the cursroban feature ?
I have already emailed twice and would love if this feature is implemented soon.

1 Like