# Cloud secret-type and snapshot review

Classify values, review baseline files and track conversation/snapshot handling separately.

Synthetic classifications and unexecuted checks. No Cursor environment, secret or snapshot is created.

Source: https://aona.ai/resources/guides/cursor-cloud-agent-secrets-snapshots/
Sources checked: 2026-09-21

## A value can cross more than one boundary

### Supply the value

Configuration, Runtime Secret or Build Secret

Note: Choose the documented purpose

### Run setup/build

Review files, output and environment access

Note: Do not persist unnecessary credentials

### Save and reuse

Review snapshot and conversation lifecycles separately

Note: No deletion result is inferred

| Item | Example classification | Review state |
| --- | --- | --- |
| Feature flag | Environment Variable candidate | Owner review |
| Runtime credential label | Runtime Secret candidate | Redaction/access scope unverified |
| Private-build credential label | Build Secret candidate | Persistence review required |
| Saved baseline file | Inspect before snapshot creation | Unreviewed |

## Review checklist

- [ ] Review files before saving the baseline
  Identify .env-style files and other credential copies without using real secrets in the exercise.
- [ ] Choose the intended secret type
  Keep agent-visible configuration, runtime values and build-only values separate.
- [ ] Record each retained-copy lifecycle
  Conversation deletion and snapshot handling are distinct provider controls.

## Included example files

- README.md
- secret-types.csv
- baseline-manifest.csv
- synthetic-values.json
- retained-copies.csv

## Source references

- Cursor: Cloud Agents: https://cursor.com/docs/cloud-agent (2026-09-21)
- Cursor: Cloud Agent Secrets and Network: https://cursor.com/docs/cloud-agent/security-network (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.