Keep secrets safe with AI coding tools: ignore files and permissions

Guide · checked against the docs on Oct 15, 2026

AI coding tools read your project to help you. That can include files you never meant to share, like a .env file full of API keys. Each tool has a way to keep files out of reach or to ask before it acts. This guide shows those settings for Cursor, Claude Code, Codex and GitHub Copilot, and what each vendor says the settings can't do. None of them is a guarantee. Everything here comes from each vendor's own docs, read on October 15, 2026.

Not affiliated with or endorsed by Anthropic, Anysphere (Cursor), OpenAI, GitHub or Microsoft. Check each vendor's current docs before relying on these details.

Our tool pages: Cursor · Claude Code · OpenAI Codex · GitHub Copilot

The short version

The rule that matters most: the safest secret is one that isn't in your project. Keep keys in a .env file that your .gitignore lists, and never paste a key into a chat with an AI tool. If a key was ever pasted, committed or shown to a tool, rotate it (make a new one and turn off the old one).

Cursor: .cursorignore

Cursor's ignore-files docs say to add a .cursorignore file in your root directory. It uses the same patterns as .gitignore:

# .cursorignore (NOT TESTED)
.env
.env.*
secrets/

Cursor's docs are clear about the limits. The terminal and MCP tools aren't covered: "The terminal and MCP server tools used by Agent cannot block access to code governed by .cursorignore". And: "While Cursor blocks ignored files, complete protection isn't guaranteed due to LLM unpredictability."

So treat .cursorignore as a helpful extra layer. It doesn't replace keeping secrets out of the project.

Claude Code: deny rules

Claude Code's settings docs say permissions cover "what Claude Code can run without asking and how to write allow, ask, and deny rules." Their example blocks reading .env files:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)"]
  }
}

(Example layout from the docs, NOT TESTED.) The docs also say "deny and ask rules apply right away." A Read rule is about reading files. Check the permissions docs for what other rule types cover before relying on it.

OpenAI Codex: sandbox and approvals

OpenAI's Codex sandbox docs describe the default for version-controlled folders as "Auto (workspace write + on-request approvals)", where "Codex can read files, make edits, and run commands in the workspace." For a careful, look-only session, the docs show:

codex --sandbox read-only --ask-for-approval on-request

(NOT TESTED.) The docs mark full access, --dangerously-bypass-approvals-and-sandbox (alias --yolo), as "Elevated Risk" with "No sandbox; no approvals (not recommended)". In the modes the docs describe, Codex can read files in your workspace, so keep secrets out of the project folder.

GitHub Copilot: content exclusion

GitHub's content exclusion docs say "Repository administrators, organization owners, and enterprise owners can manage content exclusion settings." It's listed for "Organizations with a Copilot Business or Copilot Enterprise plan."

GitHub lists clear limits on its content exclusion page: "Content exclusion is currently not supported in Edit and Agent modes of Copilot Chat in Visual Studio Code and other editors." And: "It's possible that Copilot may use semantic information from an excluded file if the information is provided by the IDE indirectly."

Habits that work in every tool

• Keep secrets out of the repo. Use a .env file and list it in .gitignore.
• Don't paste keys into chats. A pasted key has left your machine.
• Rotate anything that leaked. If a key was committed, pasted or shown to a tool, make a new one and turn off the old one.
• Keep approvals on. Let the tool ask before it runs commands until you trust what it does.
• Use ignore and deny settings as an extra layer, not your only one. Every vendor above says its setting has limits.

For keeping MCP server tokens out of config files, see our MCP setup guide. For what your agent reads at the start, see our AGENTS.md and CLAUDE.md guide.

Not affiliated with or endorsed by Anthropic, Anysphere (Cursor), OpenAI, GitHub or Microsoft. Check each vendor's current docs before relying on these details.