How to Push a Cursor Project to GitHub

If you built your app in Cursor, it lives in a folder on your own computer, and none of it reaches GitHub on its own. You put the folder under Git, publish it once, then push whenever you want GitHub to catch up.

Cursor adds its AI features on top of the standard Source Control panel it shares with VS Code, and it uses the same default shortcuts. So the steps below follow VS Code's documentation and work the same way in Cursor.

Before you start

• Git installed. In Cursor, open Terminal > New Terminal and run git --version. If you don't see a version number, install Git from git-scm.com and restart Cursor.

• Your name and email set for commits. These label your commits; they aren't your login:

  git config --global user.name "Your Name"
  git config --global user.email "you@example.com"

• A GitHub account. It's free at github.com.

Check your .gitignore first

This is the step that matters most. GitHub's docs are clear: never add, commit or push passwords or API keys to a repository. Before your first commit, open .gitignore in the root of your project (create it if it's missing) and make sure it lists at least:

node_modules/
.env
.env*.local

If your project keeps secrets in other env files, add those too. One thing to know: Cursor already keeps .env files out of its AI context by default, but that's a Cursor setting. Git will still commit a .env file unless .gitignore lists it.

Push your Cursor project to GitHub

Prefer the terminal?

GitHub's command-line route works in Cursor's terminal too. First create an empty repository on GitHub, without a README, license or .gitignore (GitHub's docs say this avoids errors), and copy its URL. Then run:

git init -b main
git add .
git commit -m "First commit"
git remote add origin https://github.com/your-name/your-repo.git
git push -u origin main

Already did Steps 1 to 3 in the Source Control view? Skip the first three commands and start at git remote add. If your branch isn't called main, use its name in the last command instead.

What changes after you push

Nothing syncs on its own. New commits stay on your computer until you push them. In the Source Control view, select More Actions (...) > Push. Sync Changes does a little more: it pulls changes from GitHub first, then pushes yours.

.gitignore only affects files Git isn't tracking yet. If a .env file already went into a commit, adding it to .gitignore afterwards doesn't remove it. Git's docs say to run git rm --cached <file> to stop tracking it. If it held a real key, rotate the key too: GitHub's docs say revoking or rotating a leaked secret comes first.

Cursor's ignore files aren't Git's. A .cursorignore file controls what Cursor's AI can see. It doesn't keep anything out of your repository.

Agent commits can carry a trailer. When Cursor's Agent makes commits or pull requests for you, it can add a Made with Cursor trailer. It's on by default. Turn it off in Cursor Settings > Agent > Attribution (from Cursor 3.11, Cursor Settings > Git & PRs > Attribution).

Your environment variables stay on your machine. With .env ignored, your keys stay out of the repository. When you deploy, you add the same variables in your host's settings.

Before you ship: what to check in the repo

Code written fast with an AI agent deserves one careful read. Do it on GitHub, before real users arrive:

1. No env files in the repo. Browse the repository on GitHub for .env* files. If one slipped in, follow the steps above and rotate the keys. More on why: secret exposure.
2. No secret keys behind NEXT_PUBLIC_ or VITE_. Those prefixes put a value into the code sent to the browser. Stripe secret keys, AI provider keys and Supabase service role keys must only be read on the server. See Secret API key exposed in client bundle.
3. Row level security on every table. If your app uses Supabase, each table needs RLS enabled with policies tied to the signed-in user. See Missing row level security.
4. API routes check auth on the server. Every route that touches user data should confirm the caller and check they own what they're asking for. See Auth check only in client code and IDOR on a REST endpoint.
5. Sign-in and AI endpoints are rate limited. See No rate limiting on sensitive endpoints.
6. One error doesn't blank the app. See Missing error boundary.

For a fuller pre-launch list, see Is My Cursor Project Ready to Ship?

Get a review before you launch

Once the code is on GitHub, installing the FinishKit GitHub App and granting it access to the repository gets you the full review: all eight production readiness dimensions and a Finish Plan that tells you which blockers to fix first. It works whether you published the repository as private or public. A public repo can also get the free quick readiness check from just its URL, a lighter first pass without a Finish Plan.

Sources: Cursor: Git, Cursor: Migrate from VS Code, Cursor: Ignore files, VS Code: Source control quickstart, VS Code: Staging and committing changes, VS Code: Repositories and remotes, GitHub Docs: Adding locally hosted code to GitHub, GitHub Docs: Removing sensitive data from a repository, Git: gitignore, Vite: Env variables and modes, Next.js: Environment variables.