diff --git a/.cursorignore b/.cursorignore
new file mode 100644
index 0000000..9d5b640
--- /dev/null
+++ b/.cursorignore
@@ -0,0 +1,9 @@
+.env*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.cert
+credentials.*
+secrets.*
diff --git a/.cursorindexingignore b/.cursorindexingignore
new file mode 100644
index 0000000..9d5b640
--- /dev/null
+++ b/.cursorindexingignore
@@ -0,0 +1,9 @@
+.env*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.cert
+credentials.*
+secrets.*
diff --git a/nginx.conf b/nginx.conf
index 344362f..047714a 100644
--- a/nginx.conf
+++ b/nginx.conf
@@ -47,6 +47,12 @@ http {
             add_header Cache-Control "public";
         }
 
+        # Block access to hidden files (especially .git)
+        location ~ /\. {
+            deny all;
+            return 404;
+        }
+
         # Health check
         location = /api/health {
             proxy_pass http://outline;
diff --git a/scripts/.cursorignore b/scripts/.cursorignore
new file mode 100644
index 0000000..9d5b640
--- /dev/null
+++ b/scripts/.cursorignore
@@ -0,0 +1,9 @@
+.env*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.cert
+credentials.*
+secrets.*
diff --git a/scripts/.cursorindexingignore b/scripts/.cursorindexingignore
new file mode 100644
index 0000000..9d5b640
--- /dev/null
+++ b/scripts/.cursorindexingignore
@@ -0,0 +1,9 @@
+.env*
+*.pem
+*.key
+*.p12
+*.pfx
+*.crt
+*.cert
+credentials.*
+secrets.*