Developer data protection
Cursor
Review Cursor cloud secrets
Before saving a Cursor Cloud Agent environment, decide which values belong in ordinary configuration, Runtime Secrets or Build Secrets, and keep unnecessary credentials out of files on the baseline disk. Then review conversation and snapshot retention separately. Redaction from an agent transcript is not a promise that a value cannot exist elsewhere in the environment.
For Cloud-development security
Separate configuration, runtime access and build-time credentials.
Synthetic classifications and unexecuted checks. No Cursor environment, secret or snapshot is created.01
Review what the baseline actually contains
A reusable environment can contain files copied during setup as well as installed dependencies. Cursor’s Cloud Agent documentation warns that a .env.local file included during snapshot creation will be saved. Review the baseline before saving it rather than relying on a later transcript-redaction setting.
List files and values needed for the task, then separate non-sensitive configuration from credentials. Use a synthetic baseline manifest for the review exercise. Do not create a test snapshot containing a real token to see whether it is retained; that would introduce the exposure the review is meant to avoid.
Source context: Cursor: Cloud Agents
02
Use the documented secret type for its purpose
Cursor distinguishes Environment Variables, Runtime Secrets and Build Secrets. Environment Variable values are visible to the agent and are intended for configuration the agent can use. Runtime Secrets remain environment variables internally, but their values are redacted from the documented tool results, transcript and commit surfaces.
Build Secrets are available to the configured Docker build process and are not exposed to the running agent’s environment. Choose the type that fits the need and follow the supported mechanism. This distinction does not authorize writing a credential into a file, command output or reusable baseline.
| Type | Documented availability | Review question |
|---|---|---|
| Environment Variable | Visible to the cloud agent | Is this genuinely non-sensitive configuration? |
| Runtime Secret | Runtime variable with specified redaction | Who else can access the environment or terminal? |
| Build Secret | Docker build process only | Does the build avoid persisting the value? |
Source context: Cursor: Cloud Agent Secrets and Network
03
Check the boundary around runtime redaction
The current documentation states that Runtime Secrets are still visible to users interacting with the environment through its Terminal. Redaction therefore has a defined output scope; it should not be described as removing the value from every location or blocking every person with environment access.
Review who can interact with the environment, what setup and build steps write, and what diagnostic material can be exported. If a fake marker is used for a manual review, record the specific surface checked. An empty transcript field is not proof that the baseline disk, terminal or another retained copy contains no value.
Source context: Cursor: Cloud Agent Secrets and Network
04
Keep conversation and snapshot lifecycles separate
Cursor’s detailed Cloud Agent documentation says conversation history is retained indefinitely by default, while environment snapshots follow a maximum 90-day inactivity window that extends when a snapshot is used again. It also distinguishes deletion of conversation history from snapshots, which follow their own documented lifecycle.
Record the organisation’s current supported retention setting and its scope. Do not infer that deleting a visible conversation deletes a saved environment, or that a high-level privacy summary answers every retained-copy question. These are provider-documented terms reviewed on 21 September 2026, not independently measured deletion results.
Source context: Cursor: Cloud Agent Secrets and Network
05
Approve the saved environment with evidence
The pack combines a secret-type record, baseline manifest and separate retained-copy sheet. Complete them before the environment is approved for company work. Record unresolved files, credentials or access holders and assign an owner instead of labelling the entire snapshot safe.
Revisit the baseline when setup steps, dependencies, secret types or environment access change. Use only fake markers for any optional verification. Repository search-index retirement is a different task; this review concerns values present when a cloud environment or snapshot is created and reused.
Put it into practice
Cloud secret-type and snapshot review
Classify values, review baseline files and track conversation/snapshot handling separately.
Synthetic classifications and unexecuted checks. No Cursor environment, secret or snapshot is created.
Supply the value
Configuration, Runtime Secret or Build Secret
Choose the documented purpose
Run setup/build
Review files, output and environment access
Do not persist unnecessary credentials
Save and reuse
Review snapshot and conversation lifecycles separately
No deletion result is inferred
| Item | Example classification | Review state |
|---|---|---|
| Feature flag | Environment Variable candidate | Owner review |
| Runtime credential label | Runtime Secret candidate | Redaction/access scope unverified |
| Private-build credential label | Build Secret candidate | Persistence review required |
| Saved baseline file | Inspect before snapshot creation | Unreviewed |
Work through your review
Use the checks to organise the evidence you need. Your selections stay in this tab.
0 of 3 reviewed
Example files for this task
Keep the source material and the instructions together. You can also download the complete worksheet or matrix as CSV.
README.mdInspect
# Cursor saved-environment review
Synthetic planning pack only. No cloud environment, snapshot, secret or API call is created. Do not use real credentials to test persistence.
1. Classify each required value in secret-types.csv.
2. Review files in baseline-manifest.csv before an authorised administrator saves an environment.
3. If your organisation permits an isolated manual check, use only the labels in synthetic-values.json and record exactly which output or retained surface was reviewed.
4. Complete retained-copies.csv separately for conversations and snapshots. A hidden transcript value is not evidence of absence from every copy.
## Guide and sources
Canonical guide: https://aona.ai/resources/guides/cursor-cloud-agent-secrets-snapshots/
Source review: 2026-09-21
- Cursor: Cloud Agents: https://cursor.com/docs/cloud-agent
- Cursor: Cloud Agent Secrets and Network: https://cursor.com/docs/cloud-agent/security-network
secret-types.csvInspect
purpose,synthetic_value_label,type_to_review,access_or_persistence_question,owner,status
Public feature flag,SYNTHETIC_FEATURE_ON,Environment Variable,Is agent visibility appropriate?,ASSIGN,UNREVIEWED
Runtime credential,NOT_A_CREDENTIAL_D15_RUNTIME,Runtime Secret,What redaction and terminal access apply?,ASSIGN,UNREVIEWED
Build-only credential,NOT_A_CREDENTIAL_D15_BUILD,Build Secret,Does the build avoid persisting it?,ASSIGN,UNREVIEWED
baseline-manifest.csvInspect
synthetic_file,purpose,contains_fake_secret_marker,decision_before_snapshot,evidence
app-config.json,Public feature flags,NO,REVIEW,
.env.local,Illustrative credential-bearing file,YES,DO NOT INCLUDE REAL CREDENTIAL COPIES,
build-output.txt,Illustrative build output,TO_CHECK,REVIEW FOR PERSISTED VALUES,
synthetic-values.jsonInspect
{
"notice": "FAKE LABELS ONLY; DO NOT REPLACE WITH CREDENTIALS",
"configuration": "SYNTHETIC_FEATURE_ON",
"runtime": "NOT_A_CREDENTIAL_D15_RUNTIME",
"build": "NOT_A_CREDENTIAL_D15_BUILD",
"tests_performed": "NONE"
}
retained-copies.csvInspect
copy,provider_documented_default,current_organisation_setting,observed_evidence,owner,status
Conversation history,Indefinite default in reviewed documentation,RECORD,UNTESTED,ASSIGN,UNREVIEWED
Environment snapshot,90-day inactivity lifecycle in reviewed documentation,REVIEW APPLICABILITY,UNTESTED,ASSIGN,UNREVIEWED
Exported diagnostic material,Separate copy to identify,RECORD,UNTESTED,ASSIGN,UNREVIEWED
Before you proceed
Keep these distinctions clear
- Treating Runtime Secret as absent from the environment
- Its documented redaction scope differs from access through the environment’s Terminal.
- Deleting a conversation and assuming the snapshot is gone
- Review the snapshot’s separate lifecycle and the current supported retention controls.
Apply it to employee AI use
Bring your actual data path.
Aona can help assess supported employee endpoint interactions associated with coding work.
Aona does not configure Cursor Cloud Agent secret types or prove deletion of hosted snapshots. No agentless cloud protection is implied.
Keep the cloud environment review with its owner; discuss any supported local endpoint data path separately using synthetic material.
Review your use caseFAQ
Questions for this decision
Can a .env.local file become part of a saved cloud environment?
Does runtime redaction mean no user can see the secret?
Does deleting an agent conversation delete its environment snapshot?
Have the synthetic values been tested against Cursor cloud?
Evidence behind the guide
Sources and scope
Prepared by Aona. Sources checked 2026-09-21. The cited material supports the specific points below; it does not certify a product or your use case.
- Cursor: Cloud Agents
Explains saved environment behaviour, including .env.local files included in snapshots.
vendor · checked 2026-09-21 - Cursor: Cloud Agent Secrets and Network
Documents secret types, runtime-terminal access, conversations and snapshot lifecycles.
vendor · checked 2026-09-21