Security Issue: Contrary to docs, Cursor does NOT check .gitignore

[Colin]

Hey @FrankieSimon!

Have a look at this thread.

Cursor does not ignore files in .gitignore

Hey @nickredmark, per the docs the current behavior is expected. .gitignore and the default ignore list which includes .env* only apply to indexing. To block access for Agent, Tab, and Inline Edit, you need .cursorignore. It’s a separate, stricter mechanism. From the docs: Ignore File | Cursor Docs .cursorignore blocks access from: Semantic search, Tab, Agent, Inline Edit, and @ mentions. Default ignore list and .gitignore apply to indexing only. So .cursorignore isn’t a workaround, it’s t…