Cursor reads .env anyway - so is committing to private repos actually the safer option?