Does Cursor handle secrets safely?

Cursor does not have built-in awareness of secret management best practices and may place API keys, database URLs, or authentication tokens directly in source code files. The AI follows patterns from its training data, which includes many examples of hardcoded credentials in tutorials and Stack Overflow answers. Secrets in source code can end up in version control history, client-side bundles, and error logs. Always use environment variables and verify that .env files are in your .gitignore. UNPWNED checks client-accessible bundles and responses for supported exposed-secret patterns; source history and server-side secrets require separate review.