Does Cursor handle secrets safely?

Cursor does not have built-in awareness of secret management best practices and may place API keys, database URLs, or authentication tokens directly in source code files. The AI follows patterns from its training data, which includes many examples of hardcoded credentials in tutorials and Stack Overflow answers. Secrets in source code can end up in version control history, client-side bundles, and error logs. Always use environment variables and verify that .env files are in your .gitignore. UNPWNED scans your deployed application for exposed secrets, API keys, and credentials that may have been inadvertently included by AI-generated code.