Why .cursorignore is not DLP

.cursorignore is useful. It is not DLP.

Teams often treat an ignore file as a security control: add .env, ship a PR, and assume Cursor cannot expose secrets. That assumption fails in the places that matter for AI coding assistants — file reads the agent still performs, shell output the model still sees, and privacy settings that change retention without redacting prompts.

What .cursorignore actually does

Ignore files tell the editor which paths to de-emphasize for indexing and some context features. They do not:

• Intercept tool calls that read files
• Scrub secrets from terminal or command output before they enter the model context
• Replace credentials with typed placeholders so the assistant can keep working without the raw secret
• Produce an audit trail of what was blocked or redacted

If an agent (or a developer) opens .env, pastes a key, or runs a command that prints a token, the ignore list does not rewrite that content on the way out.

Terminal bypass and agent file reads

Modern Cursor workflows are tool-heavy. Agents read files, run shell commands, and summarize results. Secrets commonly appear in:

• .env / .envrc and sibling env files
• printenv, cat, and deploy scripts
• CI logs and local debug output pasted into chat

An ignore entry does not sit on that path. For a control that does, see Cursor Security & DLP and the AI coding assistant DLP overview.

Privacy Mode is not redaction

Privacy Mode and similar product settings typically change how prompts may be retained or used by the vendor. They do not mean “strip API keys from this turn before the request leaves the machine.”

Redaction and retention are different layers:

| Control | What it changes | | --- | --- | | .cursorignore | Indexing / some context inclusion hints | | Privacy Mode | Vendor retention / training posture | | Hook DLP | Content rewritten locally before egress |

If your requirement is “plaintext secrets must not reach the model,” you need a pre-execution control — not an ignore file.

What hook DLP does instead

ReclaimLLM installs hooks for Cursor (and other assistants) so high-risk reads and shell outputs can be redacted on the device before they are sent. Matched credentials are replaced with labeled placeholders such as [REDACTED:API_KEY] while preserving enough structure for the assistant to continue. Configure substitutions and folder filters as described in sensitive data docs.

Install Cursor hooks with:

rclm-hooks-install --cursor

For the governance picture — redaction at the hook, sensitive-session handling, and gateway options — see DLP governance.

Bottom line

Use .cursorignore for hygiene. Use hook DLP when the threat model is secret egress to Cursor’s model. Privacy Mode does not close that gap.