From the recent changelog:<p><pre><code> Ignore files: Improved .cursorignore behavior to more consistently exclude files
</code></pre>
I don't think I'm crazy to think that a .ignore file should result in perfectly consistent ignoring...
how can it upload a .env when its there in .gitignore? even if you go and remove the entry of .env from .gitignore, it doesn't start getting tracked right?<p>but yeah there should be some commit hook that rejects a commit like this for obvious non starters like a .env or credentials.yaml or something (UNLESS the dev explicitly goes and toggles that setting to be off)
This is the biggest concern I've with Cursor. In fact, even though I use Cursor often, I won't use it on any repository with secrets or personal information. (Based on this news, I'm happy I went that route.)<p>If the Cursor team is reading, I'd recommend that you give real-time visibility into exactly what's indexed and uploaded and have more rigorous testing and documented guarantees around .cursorignore. That would go a long way toward making people like myself feel better about the product.
I think using a secret manager like <a href="https://onboardbase.com" rel="nofollow">https://onboardbase.com</a> solves this easily. .envs are never in the codebase.