Was debugging with Cursor the other day and it just casually cat'd my .env to "check the config". Sat there for a sec like... wait, my OpenAI and Stripe keys just went into the model's context?

Tried .cursorignore but apparently in agent mode it can still read whatever it wants via the shell.

Maybe I'm being paranoid. Do you guys actually care about this, or is it a non-issue in practice? Curious how people handle it (or if they just don't).