Prevent API keys and .env from reaching ChatGPT, Cursor, and Claude Code

API keys and .env contents show up in AI coding sessions more often than security reviews expect — not because developers are reckless, but because agents read files and run commands by default.

This guide covers what usually leaks, what ignore lists and chat settings do not stop, and how hook DLP redacts secrets before they reach ChatGPT, Cursor, or Claude Code.

Where secrets enter the model context

Common paths:

1. File reads — the agent opens .env, .env.local, .envrc, or a config that embeds a token
2. Shell output — env, printenv, failed deploys, or scripts that echo credentials
3. Paste — a key lands in the prompt during debugging
4. Browser assistants — ChatGPT / Claude.ai threads fed from the same repo context via copy or extensions

If the control only filters search indexes, those paths still send plaintext to the provider.

What does not solve it alone

• .cursorignore / .gitignore — hygiene for indexing and git; not egress redaction. See why .cursorignore is not DLP.
• “Do not train on my data” toggles — retention posture, not secret stripping
• Hoping developers never open .env — agents open files without a human click

You need a control that rewrites high-risk content before the request leaves the machine.

Hook DLP: redact at the tool boundary

ReclaimLLM hooks sit at the assistant’s tool/file/shell boundary. For supported CLIs and editors (including Cursor and Claude Code), matched secrets in file reads and command output can be replaced with labeled placeholders such as [REDACTED:API_KEY] so the model never receives the raw value.

Configure substitutions and folder include/exclude filters in sensitive data docs. Sync shared rules with rclm-update after changing Global Substitutions in the app.

Install hooks:

rclm-hooks-install --cursor
rclm-hooks-install --claude

Browser and API paths differ: ChatGPT-style workflows need capture/proxy coverage rather than native Cursor/Claude hooks — see AI coding assistant DLP and install.

After capture: review and sensitive handling

Hook redaction is the primary prevention layer. Sessions that still look sensitive can be reviewed before share or export; Enterprise plans add org-oriented DLP scanning. Details and current limitations are documented under sensitive data.

For the full control stack — redact at hook, sensitive session handling, and gateway options — read DLP governance and Claude Code DLP & hooks.

Checklist

1. Inventory which tools engineers use (Cursor, Claude Code, ChatGPT, Copilot, Gemini)
2. Install hooks where native support exists
3. Add env-file and high-entropy patterns to redaction substitutions
4. Restrict capture folders if needed (include_folders / exclude_folders)
5. Verify with a test session that placeholders appear instead of plaintext keys

Prevention is local and deterministic for known patterns. Treat vendor privacy modes as complementary, not sufficient.