Ignore controls reduce exposure. They are not a security boundary

.cursorignore excludes paths from indexing, from semantic search and from the agent's default file reading, which is how you keep .env, key material and PIIPersonally Identifiable Information. Data that can identify a person (names, emails, SSNs); regulated and sensitive. Press Enter for the full definition.-laden fixtures out of ordinary context. That is real, and it belongs in your blast-radius story.

Cursor's own enterprise docs are blunt about the limit: .cursorignore is not a security boundary. It excludes files from AI processing, but a user can still open an ignored file by hand, and terminal and MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tools can't honor it at all. Enforcement is file-system permissions, approval gates, terminal sandboxing and the repo/model/MCP allowlists. Get that ordering right in an interview and you sound like someone who has read the security docs rather than the marketing page.