How is .cursorignore different from .gitignore?

.gitignore decides what git tracks. .cursorignore keeps files out of Cursor's codebase index and AI features; Cursor already skips files in .gitignore when it indexes.

Does .cursorignore reduce wasted context?

Yes. Ignored files are not indexed or pulled into requests, so build output and large data files do not crowd out your source code.

Target Standard & File Format

Select runtime specification

AI Agent Rules & Skills

Context Shields & Privacy (Ignore Files)

Integrations & Machine Documentation

AI Governance & Multi-Agent Planning Suite

.cursorignore Shield

Prevent Cursor AI from indexing secrets, build caches, and bulky lockfiles to save context window tokens:

Shield Protection ProfileFull Protection

Tokens Saved / Turn

~190k tokens

Secret Leak Guards

2 Active Guards

Shield Categories

8 of 8 Enabled

Indexing Boundary Categories

Select active exclusions

Toggle specific categories to mask secrets and exclude heavy artifacts:

Secrets & Local Credentials~5k tokens

Masks .env files, private keys, SSL certs, service accounts, and API credentials from AI indexers.

Dependency Bloat & Lockfiles~60k tokens

Excludes node_modules, vendor directories, and massive lockfiles (package-lock, yarn, pnpm, Cargo).

Build Outputs & Framework Caches~35k tokens

Filters out dist/, build/, out/, .next/, .turbo/, .cache/, and compiled bytecode artifacts.

Media & Heavy Binary Blobs~20k tokens

Omits raster images (png, jpg, webp), audio/video, fonts, zip archives, and wasm binaries.

Logs & Diagnostic Traces~15k tokens

Blocks test coverage reports (coverage/, .nyc_output/) and verbose npm/yarn/pnpm debug logs.

IDE Configurations & OS Metadata~5k tokens

Strips .idea/, .vscode/, editor swap files, .DS_Store, and Windows Thumbs.db files.

Database Dumps & Local Storage~30k tokens

Guards raw database dumps (*.sql, *.dump), SQLite database files, and journal files (*.db, *.db-wal).

Test Fixtures & Heavy Snapshots~20k tokens

Skips bloated mock JSON payloads, large test fixture folders, and verbose test snapshots.

Custom Rules & Negate Exceptions

Append repo-specific file globs or re-include allowed files with negation patterns (!path):

.cursorignore94 lines

# .cursorignore - AI Context & Token Optimization
# Prevents Cursor from indexing sensitive credentials, build caches, and bulky lockfiles.
# Keeping your AI context window clean improves reasoning quality and prevents data leaks.

# --- Critical: Secrets & Local Credentials ---
.env
.env.*
!.env.example
*.pem
*.key
*.cert
*.crt
id_rsa*
secrets/
credentials/
service-account*.json
*.p12
*.pfx
*.keystore

# --- Dependency Bloat & Massive Lockfiles (Saves 50k+ tokens) ---
node_modules/
vendor/
package-lock.json
pnpm-lock.yaml
yarn.lock
bun.lockb
poetry.lock
Pipfile.lock
Cargo.lock
composer.lock
go.sum

# --- Build Artifacts, Bundler & Framework Caches ---
dist/
build/
out/
.cache/
*.tsbuildinfo

# --- Large Binary Files & Media (Never needed by LLM) ---
*.png
*.jpg
*.jpeg
*.gif
*.ico
*.webp
*.mp4
*.webm
*.mp3
*.wav
*.zip
*.tar.gz
*.tgz
*.rar
*.7z
*.pdf
*.wasm

# --- Test Coverage & Debug Logs ---
coverage/
.nyc_output/
*.lcov
*.log
npm-debug.log*
yarn-debug.log*
pnpm-debug.log*
yarn-error.log*

# --- Editor Metadata & OS Caches ---
.idea/
.vscode/
*.swp
*.swo
*~
.DS_Store
Thumbs.db

# --- Database Dumps & Local SQLite Storage ---
*.sql
*.dump
*.sqlite
*.sqlite3
*.db
*.db-shm
*.db-wal

# --- Heavy Test Fixtures & Snapshots ---
test/fixtures/large/
tests/fixtures/
__snapshots__/
fixtures/**/*.json
mock-data/**/*.json

Click or focus to edit

IGNORE•UTF-8•94 Lines•Spaces: 2

Target File Location

Project Placement

Save as .cursorignore in project root. Masks credentials and excludes build caches and bulky lockfiles to save 50k+ tokens.

What's in the ZIP export (20 files)

Unzip into your project root. Every file is already in the folder its tool reads from.

Include extras: Claude Code subagent, Gemini CLI, Aider, Copilot and Kiro scoped rules, CI audit workflow

.claude/settings.json
.claude/skills/terraform-iac/SKILL.md
.claude/skills/terraform-iac/scripts/verify.sh
.claudeignore
.cursor/rules/terraform-iac.mdc
.cursorignore (open in editor)
.github/copilot-instructions.md
.mcp.json
.windsurf/rules/terraform-iac.md
AGENTS.md
ARCHITECTURE.md
CLAUDE.md
DESIGN.md
MEMORY.md
PRD.md
README.md
TASK.md
llms.txt
prompts/gemini-system-instructions.json
prompts/openai-custom-instructions.md

DevOps & Tooling · Cursor

Terraform & OpenTofu IaC .cursorignore

A .cursorignore for Terraform & OpenTofu IaC that keeps build output, large files and secrets out of Cursor's index (best effort).

Path: .cursorignore
Loads: Indexing and AI features
Format: gitignore syntax
Used by: Cursor

All .cursorignore presets and how .cursorignore works

What this file tells the agent

This .cursorignore keeps Terraform & OpenTofu IaC build output, large data files and environment secrets out of Cursor's index and AI features, so context goes to your source code. It is best effort: commands the agent runs in the terminal can still read ignored files, so keep real secrets out of the repo too.

Pin explicit version constraints for all providers and required Terraform/OpenTofu core versions (required_providers).
Store state securely in remote backends (S3 with DynamoDB state locking or GCS/Terraform Cloud); ban local terraform.tfstate.
Enforce mandatory resource tagging (Environment, Project, Owner, ManagedBy) on all provisioned cloud assets.
Never hardcode secrets, API keys, or master database passwords; inject via secure variables with sensitive = true or secret managers.
Declare explicit lifecycle { prevent_destroy = true } blocks on critical production databases and storage buckets.

Code to avoid, and what to write instead

The rule steers the agent away from the left and toward the right.

avoid

# Dangerous: Hardcoded secret, no version lock, unmanaged state
resource "aws_db_instance" "bad_db" {
  engine   = "postgres"
  password = "plaintextpassword123" # Leaked credentials in git!
}

write instead

terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.40"
    }
  }
  backend "s3" {
    bucket         = "corp-tf-state-prod"
    key            = "vpc/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

resource "aws_db_instance" "primary" {
  identifier          = "app-db-prod"
  allocated_storage   = 50
  engine              = "postgres"
  instance_class      = "db.r6g.large"
  password            = var.db_password
  skip_final_snapshot = false
  
  lifecycle {
    prevent_destroy = true
  }
}

Install it in one command

01
Go to your project root
The file goes at .cursorignore, relative to the root.
02
Download the file
Run the command on the right. It downloads this preset and writes the file.
03
Make sure it gets used
Cursor applies .cursorignore automatically. Matching files leave the index and AI features, but commands the agent runs in the terminal can still read them.

$ curl -fsSL "https://www.devscratchpad.tech/api/raw/cursorignore/terraform-iac" -o ".cursorignore"

writes .cursorignore

path

.cursorignore

To write the file from your own code instead, use Read your code or Convert Legacy Rules in the editor above.

More for Terraform & OpenTofu IaC

Other formats

Other .cursorignore presets

Questions

How is .cursorignore different from .gitignore?: .gitignore decides what git tracks. .cursorignore keeps files out of Cursor's codebase index and AI features; Cursor already skips files in .gitignore when it indexes.
Does .cursorignore reduce wasted context?: Yes. Ignored files are not indexed or pulled into requests, so build output and large data files do not crowd out your source code.