How to prevent environment leakage in Cursor output

1// src/config/env.ts
2const requiredEnvVars = [
3  'API_BASE_URL',
4  'AUTH_SERVICE_URL',
5  'STORAGE_URL',
6] as const;
7
8type EnvVar = (typeof requiredEnvVars)[number];
9
10function getEnv(key: EnvVar): string {
11  const value = process.env[key];
12  if (!value) {
13    throw new Error(`Missing required environment variable: ${key}`);
14  }
15  return value;
16}
17
18export const config = {
19  apiBaseUrl: getEnv('API_BASE_URL'),
20  authServiceUrl: getEnv('AUTH_SERVICE_URL'),
21  storageUrl: getEnv('STORAGE_URL'),
22} as const;

1# .cursorrules
2
3## Environment Variables
4- NEVER hardcode API URLs, database connection strings, or service endpoints
5- ALWAYS import from src/config/env.ts using: import { config } from '@/config/env'
6- Use config.apiBaseUrl, config.authServiceUrl, config.storageUrl
7- NEVER reference .env files directly in application code
8- NEVER use process.env directly outside of src/config/env.ts
9
10## API Integrations
11- All HTTP clients must use config.apiBaseUrl as the base URL
12- Authentication endpoints use config.authServiceUrl
13- File upload endpoints use config.storageUrl

1# .env.example (committed to Git)
2API_BASE_URL=https://api.example.com
3AUTH_SERVICE_URL=https://auth.example.com
4STORAGE_URL=https://storage.example.com
5
6# .env.development (NOT committed)
7API_BASE_URL=http://localhost:3001
8AUTH_SERVICE_URL=http://localhost:3002
9STORAGE_URL=http://localhost:3003
10
11# .env.production (NOT committed)
12API_BASE_URL=https://api.myapp.com
13AUTH_SERVICE_URL=https://auth.myapp.com
14STORAGE_URL=https://storage.myapp.com

1# .cursorignore
2.env
3.env.*
4!.env.example
5*.pem
6*.key
7credentials/
8secrets/

1// Example prompt in Cursor Chat (Cmd+L):
2// @src/config/env.ts Create a UserService class that fetches
3// user profiles from the /users endpoint and handles errors.
4// Use our project's config module for the base URL.
5
6// Expected generated output:
7import { config } from '@/config/env';
8
9export class UserService {
10  private baseUrl = config.apiBaseUrl;
11
12  async getProfile(userId: string) {
13    const response = await fetch(`${this.baseUrl}/users/${userId}`);
14    if (!response.ok) {
15      throw new Error(`Failed to fetch user ${userId}: ${response.status}`);
16    }
17    return response.json();
18  }
19}

1// Prompt for Cursor Chat (Cmd+L):
2// @codebase Search for any hardcoded URLs that contain
3// 'localhost', 'staging', 'dev.', or 'api.' in the src/
4// directory. List each file, line number, and the hardcoded
5// URL. Suggest how to replace each one with the appropriate
6// config import from @/config/env.