How to Fix Cursor API Key Exposure (2026)

Cursor's AI assistant can write a functioning API call in seconds. It can also bake your OpenAI key directly into that function if you are not watching closely. The model suggests code based on context it sees in your codebase, and if a key appears anywhere in that context, it may echo it right back into a new file you are about to commit.

This guide covers the three most common Cursor-specific exposure patterns, how to find them, and how to fix the root cause for Next.js and Vite apps.

The Three Cursor-Specific Exposure Patterns

Unlike app builders that deploy your app, Cursor is an IDE. The exposure risks are different.

Pattern 1: AI echoes a key from context. Cursor reads files in your project to provide accurate suggestions. If your .env or a config file is open, the model may suggest that exact key value in a new file.

Pattern 2: Wrong variable prefix. Cursor generates NEXT_PUBLIC_OPENAI_API_KEY or VITE_OPENAI_API_KEY because it has seen those patterns frequently in training data. Both prefixes are designed to put values into the browser bundle.

Pattern 3: Secrets in .cursorrules. Developers sometimes paste API keys into .cursorrules to help Cursor understand their service setup. That file gets committed, and the key is in git history.

Step 1: Find the Exposed Key

# Common key prefix patterns in Cursor-generated code
grep -rn "sk-proj-\|sk-ant-api\|sk_live_\|rk_live_\|AKIA\|eyJhbGci" . \
  --include="*.ts" --include="*.tsx" --include="*.js" --include="*.jsx" \
  --exclude-dir=node_modules

# Also search for generic secret assignment patterns
grep -rn "apiKey.*=.*['\"][A-Za-z0-9_\-]\{20,\}" . \
  --include="*.ts" --include="*.tsx" --include="*.js" \
  --exclude-dir=node_modules

# Next.js: any secret-like var with the client-bundle prefix
grep -rn "NEXT_PUBLIC_" . --include="*.ts" --include="*.tsx" --include="*.env*"

# Vite / React: same prefix class
grep -rn "VITE_" . --include="*.ts" --include="*.tsx" --include="*.env*"

cat .cursorrules 2>/dev/null || cat .cursor/rules 2>/dev/null
# Also check if it was ever committed
git log --all --oneline -- .cursorrules

git log --all --full-history -- .env
git log --all --full-history -- .env.local

Step 2: Rotate the Exposed Key Immediately

Rotate before fixing code. The key is live and usable right now.

Step 3: Remove from Git History (if committed)

# Install git-filter-repo
pip install git-filter-repo

# Remove sensitive files from all history
git filter-repo --path .env --invert-paths
git filter-repo --path .cursorrules --invert-paths  # if it contains secrets

After scrubbing, force-push to all remotes and notify collaborators to re-clone. Add the files to .gitignore:

echo ".env" >> .gitignore
echo ".env.local" >> .gitignore
# Only add .cursorrules if it contains secrets
# Otherwise keep it for team context
git add .gitignore && git commit -m "chore: gitignore sensitive files"

Step 4: Fix the Root Cause

Next.js Apps (remove NEXT_PUBLIC_)

Cursor frequently generates NEXT_PUBLIC_OPENAI_API_KEY because it has seen that pattern in training data. Remove the prefix and move the API call server-side.

Wrong (key in browser bundle):

// app/components/Chat.tsx - runs in browser, key visible in bundle
const response = await fetch("https://api.openai.com/v1/chat/completions", {
  headers: { Authorization: `Bearer ${process.env.NEXT_PUBLIC_OPENAI_API_KEY}` },
});

Right (Route Handler keeps key server-side):

// app/api/chat/route.ts - runs on server only
import { NextRequest, NextResponse } from "next/server";
import OpenAI from "openai";

const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

export async function POST(req: NextRequest) {
  const { message } = await req.json();
  const response = await client.chat.completions.create({
    model: "gpt-4o",
    messages: [{ role: "user", content: message }],
  });
  return NextResponse.json({ reply: response.choices[0].message.content });
}

Your React component calls /api/chat. Your Route Handler calls OpenAI. The key stays on the server.

Vite / React Apps (remove VITE_)

Same pattern, different platform:

Wrong (key in bundle):

// src/components/Chat.tsx
const client = new OpenAI({
  apiKey: import.meta.env.VITE_OPENAI_API_KEY,
  dangerouslyAllowBrowser: true,
});

Right (Netlify Function or Express route):

// netlify/functions/chat.ts
import OpenAI from "openai";

const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

export const handler = async (event: any) => {
  const { message } = JSON.parse(event.body || "{}");
  const response = await client.chat.completions.create({
    model: "gpt-4o",
    messages: [{ role: "user", content: message }],
  });
  return { statusCode: 200, body: JSON.stringify({ reply: response.choices[0].message.content }) };
};

Environment Variable Naming

Step 5: Fix Your .cursorrules File

If your .cursorrules file contains real API keys, clean it and add a rule to prevent Cursor from generating the pattern again:

# .cursorrules
# Rules for this project

## API Keys and Secrets
- Never hardcode API keys, secrets, or passwords in source files.
- Always use environment variables accessed via process.env on the server.
- Client components must never call third-party APIs directly. Use Route Handlers or server actions.
- NEXT_PUBLIC_ prefix is for non-secret config only (feature flags, public URLs). Never for API keys.
- Variable naming: OPENAI_API_KEY (not NEXT_PUBLIC_OPENAI_API_KEY), STRIPE_SECRET_KEY (not NEXT_PUBLIC_STRIPE_SECRET_KEY).

This gives Cursor explicit guidance so it generates correct patterns in future sessions.

Step 6: Prevent Future Leaks

Pre-commit Hook with Gitleaks

# Install gitleaks (macOS)
brew install gitleaks

# Test your current repo
gitleaks detect --source . --verbose

# Add pre-commit hook
cat > .git/hooks/pre-commit << 'EOF'
#!/bin/sh
gitleaks protect --staged --verbose
if [ $? -ne 0 ]; then
  echo "Gitleaks found potential secrets. Commit blocked."
  exit 1
fi
EOF
chmod +x .git/hooks/pre-commit

Add a .cursorignore

Like .gitignore, .cursorignore tells Cursor not to read certain files as context. Use it to keep secrets out of Cursor's context window entirely:

# .cursorignore
.env
.env.local
.env.production
.env.*.local
*.pem
*.key
secrets/

When .env is in .cursorignore, Cursor cannot read it and cannot echo your keys into generated code.