How to secure a Cursor-built app

The short ship list is Ship a Cursor app. This page is the settings and the review around that list. Cursor's site describes an agent that edits files and runs commands in a repository. You still pick the host, the database, and the payments.

Turn on Privacy Mode

Cursor's help page says Privacy Mode keeps your code from being used for training by Cursor or other model providers. Prompts and code context are still sent to the model provider when you use AI features.

Open Cursor Settings, then General, and turn Privacy Mode on. On a team it is on by default, and an admin can enforce it so members cannot turn it off. Enterprise docs say that enforcement covers Cursor-routed models, with exceptions when you bring your own key or use a model that has its own provider retention.

Privacy Mode is a training switch. It is not a reason to paste a production secret into chat.

Decide what the agent may run

Cursor's agent security doc says these are the defaults, and that they should stay on.

If auto-reload is on, an edit can run before you have read it. Use git so you can revert. The pre-launch checklist is the pass after the branch exists.

Keep secrets out of context

The help center says Cursor already ignores .env files, .git, and lockfiles by default, and that it respects .gitignore. .cursorignore is for extra paths. Ignored files are blocked from Agent, Tab, Inline Edit, and @ mentions.

The same docs say terminal commands and MCP tools run outside those file controls, so they can still read an ignored file. The ignore-file reference also says complete protection is not guaranteed, because a model is unpredictable. Treat ignore files as a layer, and keep the real secret in the host's environment settings.

A practical .cursorignore and .gitignore both list:

• .env and .env.*
• *.pem and other private keys
• Credential JSON you downloaded from a cloud console

The longer key pass is how to keep API keys out of AI-generated code. The bundle check, after you deploy, is API keys in the frontend.

Write rules, then still read the diff

Project rules live in .cursor/rules as .mdc files with frontmatter. A plain .md file in that folder is ignored by the rules system. AGENTS.md in the project root is the plain-markdown alternative, and the CLI loads it too.

Cursor's docs say rules are included in the model context so the agent has standing instructions. The enterprise controls page says the model will try to follow them and that they are not a guarantee. Use a rule for "never put a secret in source" and "enable row level security on every new table." Use a hook, or your own review, for anything that must actually block.

Team rules are managed from the dashboard on Team and Enterprise plans.

Review what the agent added

• Read the diff, including lockfiles. If the agent can add packages, put Socket, Snyk, or Aikido on the repo. The comparison is Snyk vs Socket vs Aikido.
• Search the branch for a secret that was written to make a script run. If it was committed, rotate it, then remove it.
• Name the host. Public env prefixes are still public on Vercel, Netlify, and Render.
• If the database is Supabase, follow how to set up row level security. A login screen is not that policy.
• If the app charges, verify the webhook on the server. See the Stripe checklist and the payments category.

Then add error reporting from the monitoring category before the first user who is not you.

FAQ

Does Privacy Mode stop my code from being sent to a model?

No. Cursor's privacy help says AI features send prompts and code context to model providers, and that Privacy Mode means that code is not used for training. You still should not put production secrets in the chat or in files the agent can read.

Will .cursorignore stop the agent from reading .env?

It blocks Agent, Tab, Inline Edit, and @ mentions from ignored files, and the help center says .env files are already ignored by default. Cursor's docs also say terminal commands and MCP tools do not honor .cursorignore. A command you approve can still print the file.

Are project rules a security control?

They are standing instructions. Cursor's controls documentation says rules are suggestions to the model, not a guarantee. Put the rule in the repo, and review the diff for the cases that matter: a new table, a new key, a new dependency.

Does Cursor deploy the app?

No. Cursor works in the repository. You deploy to whatever host the project uses, or you leave it on the builder that created it. The Cursor tool page is the directory entry. The launch pass for the running URL is the pre-launch checklist.

Sources

Checked 21 Oct 2026.

• Cursor privacy
• Cursor agent security
• Cursor ignore file
• Cursor ignore files help
• Cursor rules
• Cursor LLM safety and controls