仓库密钥边界规则：.env 不进上下文
要把 .env 挡在 Agent 上下文之外的 Cursor 仓库维护者。路径：.cursor/rules/secrets-boundary.mdc
不是 Roo / Cline 模版。本站不托管安装包。订哪档去 /compare。
把 .cursor/rules/secrets-boundary.mdc 放到仓库根的 .cursor/rules/。这是 Cursor Project Rules 路径，不是 Roo 的 .roo，也不是 Cline 的 .clinerules。
规则投进仓库之后，再去 /compare 对照 Pro / Business / 自备 Key。本站不托管安装包，桌面 IDE 走 /downloads。
.cursor/rules/secrets-boundary.mdc---
description: Secrets stay out of agent context — do not load .env contents
alwaysApply: true
---
# Secrets boundary
- Do not read `.env`, `.env.local`, `.env.production`, `.env.*`, `*.pem`, `*.key`, `credentials.json`, or similar secret files into the conversation.
- If a task needs a credential, refer to the environment variable name only (`DATABASE_URL`, `GITHUB_PERSONAL_ACCESS_TOKEN`). Never paste a live value.
- `.cursor/mcp.json` must use `${ENV_NAME}` placeholders. Do not commit tokens, cookies, or private keys.
- Do not print secrets in logs, diffs, test fixtures, screenshots, or README examples.
- Redact anything that looks like a key before quoting CI output.
- Do not rotate production credentials as a debugging step. Do not write secrets into `AGENTS.md` or Skill files.
- This is a Cursor project rule (`.cursor/rules/*.mdc`), not a Roo `.roomodes` file.