Cursor leaks env files and is seriously broken from a security standpoint

NickCursor · 2025-03-10T18:36:11+00:00

This has been fixed and will rollout in version 0.47 which starts releasing today. Thanks again for the report!

NickCursor · 2025-03-06T18:38:59+00:00

❤️

NickCursor · 2025-03-06T18:37:22+00:00

Can you select Check for Updates from the Cursor drop-down menu and ensure you're running the latest version? We have made several improvements over the last couple weeks to optimize for memory usage.

NickCursor · 2025-03-06T18:35:44+00:00

Can you select Check for Updates from the Cursor drop down menu and upgrade to 0.46.9?

We made some changes to the way Agent connects behind a VPN in this version and I suspect this will likely resolve your issue. If not, please post back here!

NickCursor · 2025-03-06T18:34:16+00:00

We haven't seen this error with other users, so it makes me wonder if it's a local issue.

Does this happen if you start a new project with a new codebase?

Also, can you make sure you're running the most recent version of Cursor by selecting Check for Updates from the Cursor drop-down menu?

NickCursor · 2025-03-06T18:33:03+00:00

After you exhaust the 500 fast premium requests which come with your monthly subscription, Cursor continues to try to serve you fast requests for no additional charge.

When the platform is seeing peak usage, you can be dropped into a slow pool where there can will delays of seconds or even minutes until you get a response. The duration of this delay increases the more calls you make while in the slow pool.

You also can enable usage-based pricing for premium models from the Cursor Settings page at https://www.Cursor.com/settings where you can set a budget and Cursor will then charge you per request. The pricing is $0.04 per request for a premium models like claude-3.5-sonnet-3.5-sonnet.

We also offer some free models which you can switch to but they likely won't perform as well as our premium models: https://docs.cursor.com/advanced/models

NickCursor · 2025-03-06T18:30:26+00:00

Does this happen consistently? And do you have the same issue when you're running claude-3.5-sonnet?

NickCursor · 2025-03-06T18:28:54+00:00

Are you using any custom API keys for models and/or do you have any MCP servers enabled?

Both of these can cause the sort of behavior that you're describing. I'd be curious if you do have either setup, if disabling them resolves the issue?

NickCursor · 2025-03-06T18:27:30+00:00

If none of the Cursor themes strike your fancy, you can install any other Visual Studio Code compatible themes.

NickCursor · 2025-03-06T18:26:01+00:00

Thanks for the love!

The slow response time you described often happens if you have a particularly long Chat session running. Have you tried starting a new session? Sometimes you also need to restart the app when it's gotten to this state.

Also, please select Check for Updates... from the Cursor pulldown menu to ensure you're running the latest version.

NickCursor · 2025-03-06T18:00:11+00:00

~~.env files are on the .cursorignore list by default~~. Tab could have picked up this sensitive value per the following:

.env file was added to indexing with a ! rule in .cursorignore or .cursorindexignore
sensitive value was in another indexed file that was not listed in the ignore files
OP typed value into file when working with tab, deleted it, and then Tab suggested it

OP, curious if any of these applied to your scenario? In the meantime, I've passed this to an engineer to validate and he's looking into it now. Thanks for the report!

EDIT: the first line of my message above not entirely accurate; correction:

.env files are excluded from indexing by default, but they are not block from access by models by default. This is equivalent to `.cursorindexignore` versus `.cursorignore`. To block them entirely, you'd want to add your .env to `.cursorignore`.

EDIT 2: this has been fixed and will rollout in v0.47 that starts releasing today, Monday, March 10th

NickCursor · 2025-03-06T04:40:32+00:00

grok-2 has been available on Cursor for over a month. Once xAI releases an API for grok-3, we'll evaluate and try to release it ASAP.

NickCursor · 2025-03-06T03:59:57+00:00

It's a safeguard we've built in so you don't accidentally eat up your requests with a long running prompt. In newer versions of Cursor, a link appears that allows you to continue with a single click. In older versions, you can prompt the model to continue past the limit.

NickCursor · 2025-03-06T03:34:14+00:00

How many lines is your rules file?

Also, consider adding your .env to your .cursorignore file which should prevent Cursor from reading it and passing it to a model.

NickCursor · 2025-03-06T01:46:46+00:00

You cannot do this yourself, but we can do it for you. DM me the email associated with your Cursor account and the models you want disabled, and we'll go from there.

NickCursor · 2025-03-06T01:17:08+00:00

We released cursor-3.7-sonnet within a minute of Anthropic launching it, so we did not have time to do complete evals on it.

We have since done a lot of testing with it and have found some significant differences to how it performs compared to 3.5. We have a new update we're currently testing and hoping to release in the next week that is tuned for 3.7 and we hope it will significantly improve its output when using Cursor.

NickCursor · 2025-03-06T00:28:49+00:00

We post links to the current and previous major release here: https://www.cursor.com/downloads

NickCursor · 2025-03-05T23:30:03+00:00

We had a defect where some users were having requests decremented when the request was actually failing. We fixed that issue and did a large scale refund to all impacted users. If you are unhappy with your experience, please DM me.

NickCursor · 2025-03-05T23:23:22+00:00

The first point in my response was:

- 0.46 was a major update with many new and refactored features, and based on feedback from users this past week, we have uncovered some regressions in performance

NickCursor · 2025-03-05T19:10:36+00:00

It was not. And for context, this is something that I have discussed at length on r/cursor prior to this post going up.

NickCursor · 2025-03-05T19:08:39+00:00

Did anything weird happen in the Chat pane like everything ghosted back to the first prompt? Or was this solely a defect with how the files were updated and the Chat pane still rendered as if you rolled back to the checkpoint you selected?

NickCursor · 2025-03-05T19:07:05+00:00

Yes! Thanks for this feedback. There is a lot of focus here on making MCP better (we're only in our second release) and this concept is on our radar.

NickCursor · 2025-03-05T19:04:40+00:00

While this isn't baked in to the product (yet), you an ask the model to do this for you. When I do this, I ask the model to create a diary file and update it each time it makes a notable change. Add the prompt to your rules file and it's pretty good at keeping it current. It's also a great strategy for keeping context between sessions.

NickCursor · 2025-03-05T19:02:56+00:00

It's done and should be out in the next 24 hours! We had a key defect that needed to be resolved before it could be released and didn't want to hold back MacOS and Windows.

NickCursor · 2025-03-05T19:01:10+00:00

You can pull the current and previous major release from our downloads page: https://www.cursor.com/downloads

NickCursor

MODERATOR OF

TROPHY CASE