Cursor security checklist for the app you ship

Cursor is an editor, so the security of what you ship depends on your framework, your host and the code Cursor helps you write. Check two places, the project and the live site. Atlas, our example app at atlas.example, is the example.

What does Cursor keep out of the AI's context?

Cursor already ignores .env files, .git/ and lock files by default. Cursor also says terminal commands and MCP tools run outside its file access controls, so they may still be able to read ignored files. So a secret in .env is not sent as context by default, but an agent that runs commands can still read it. Approve commands with that in mind.

Which values end up in the shipped code?

That depends on the framework, not on Cursor.

Vite exposes variables prefixed with VITE_ in client-side source code after bundling. Next.js keeps variables without the NEXT_PUBLIC_ prefix out of the browser. A secret with a public prefix is published the moment you deploy.

How to check and fix from Cursor

1. Deploy and copy the live address.
2. Run a quick check on your published address to see what a stranger sees, then read how we check for what it covers.
3. Add Lockpick to Cursor so the agent can read each finding and its fix prompt.
4. Ask it to fix one finding on a new branch, review the diff, then deploy and check again.

An outside check sees the deployed site, not your repository, so it will not find a secret that never left your machine. It finds the ones that did.