Questions on .gitignore, .cursorignore, .cursorban

Ideas Feedback
16

@ericzakariasson 0.46 is out and changelog is here - Changelog - Feb 19, 2025 | Cursor - The AI Code Editor | Cursor - The AI Code Editor
Here’s what I see:

  • Ignore files: .cursorignore now blocks files from being added in chat or sent up for tab completions, in addition to ignoring them from indexing. We’ve introduced .cursorindexingignore for specifically controlling file indexing.

Given the language at Security | Cursor - The AI Code Editor, I’m not sure I understand the new intended state of how to manage secrets:

Files and subdirectories specified by ‘.gitignore’ or ‘.cursorignore’ are ignored. …

  • While a ‘.cursorignore’ file can prevent files from being indexed, those files may still be included in AI requests, such as if you recently viewed a file and then ask a question in the chat. We are considering adding a ‘.cursorban’ file to address the use case of wanting to block files from being sent up in any request — please make a forum post or reach out at [email protected] if this is a feature that would be interesting to you.

In my opinion, Cursor strongly needs 1.) a Docs page in the header for quick access, and 2.) a dedicated “Secrets Management” docs page that specifically mention the use cases for when one needs to use .gitignore vs .cursorignore vs .cursorindexingignore vs .cursorban, and how best to keep secrets out of cursor.

While it’s nice that docs search is endowed with RAG over the docs, it needs to be endowed the ability to cite references or, preferably, to switch to a classical search mode so we can get citable links to “see the proof.” I asked this question, and all I got was an answer (which looks to be accurate as of 0.46 - great!), but without any citable links to the documentation, which is what I really wanted, so I can link in my team’s documentation on how to use Cursor safely:

image
image1350×1514 259 KB

@ericzakariasson will you please impress upon the cursor documentation team how critical it is to enterprises and business teams to dispel any possible ambiguity about how secrets can be kept out of cursor.

UPDATE - I see that there’s a Cursor – Ignore Files docs page. I think I understand now, so .cursorindexingignore automatically inherits .gitignore, but .cursorignore doesn’t? That could be clearer. Under Cursor – Ignore Files I see that the files ignored by default include .env, but I definitely saw one instance of the agent looking inside my .env file this weekend on 0.46, even though .env was explicitly specified in .gitignore… which was a PITA since I then had to rotate my secrets (thank goodness I was using API keys scoped to the project). So I take it that the “files ignored by default” actually just should be called “files ignored from indexing by default”?