Why Cursor Keeps Hardcoding Your API Keys (And How to Stop It)

TL;DR AI assistants trained on public repos reproduce hardcoded secrets because that's what they learned A pushed API key is effectively public even after deletion -- git history doesn't forget Add gitleaks as a pre-commit hook today -- five minutes, blocks the problem at the source I've been doing code reviews for teams that have fully switched to AI-assisted workflows. Cursor, Copilot, Claude Code -- all of them. And there's one pattern I keep seeing that doesn't get enough attention: har...