diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e9d04f..7049262 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,9 @@
 
 ### Changed
 
+- `set exrc`/`set secure` are now opt-in via `g:chopsticks_enable_exrc = 1`;
+  Vim no longer sources project-local `.vimrc`/`.exrc` from the working
+  directory by default
 - `,?` cheat sheet is now profile-aware and hides LSP/ALE/preview/UndoTree keys
   when those features are disabled
 - Module reload/source paths now use `fnameescape()` so installs in paths with
diff --git a/README.md b/README.md
index b30b6c9..8830ed3 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,7 @@ let g:chopsticks_enable_sudo_save_bang = 1 " optional: :w!! sudo save
 let g:chopsticks_enable_completion_keymaps = 1 " optional: Tab/Enter completion
 let g:chopsticks_enable_auto_pairs = 1 " optional: automatic pair insertion
 let g:chopsticks_enable_terminal_keymaps = 1 " optional: terminal Esc/Ctrl navigation
+let g:chopsticks_enable_exrc = 1 " optional: source project-local .vimrc/.exrc from CWD
 ```
 
 `minimal` avoids LSP, ALE, completion plugins, extra language syntax plugins,
diff --git a/modules/core.vim b/modules/core.vim
index f187f6a..70d03b4 100644
--- a/modules/core.vim
+++ b/modules/core.vim
@@ -183,8 +183,10 @@ endif
 
 " ── Project-Local Config ────────────────────────────────────────────────────
 
-set exrc
-set secure
+if get(g:, 'chopsticks_enable_exrc', 0)
+    set exrc
+    set secure
+endif
 set sessionoptions=blank,buffers,curdir,folds,help,tabpages,winsize,winpos,terminal
 
 if has("patch-8.1.0360")
diff --git a/scripts/test.sh b/scripts/test.sh
index 218ae6e..fd73ed8 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -236,6 +236,16 @@ check_vim() {
         -c 'if has("terminal") && (maparg("<Esc><Esc>", "t") !~# "<C-\\\\><C-N>" || maparg("<C-h>", "t") !~# "<C-W>h" || maparg("<C-j>", "t") !~# "<C-W>j" || maparg("<C-k>", "t") !~# "<C-W>k" || maparg("<C-l>", "t") !~# "<C-W>l") | cquit | endif' \
         -c 'qa!' 2>&1
 
+    XDG_CONFIG_HOME="$EMPTY_XDG" vim -u .vimrc -i NONE -es -N \
+        -c 'if &exrc || &secure | cquit | endif' \
+        -c 'qa!' 2>&1
+
+    XDG_CONFIG_HOME="$EMPTY_XDG" vim -u NONE -i NONE -es -N \
+        -c 'let g:chopsticks_enable_exrc = 1' \
+        -c 'source .vimrc' \
+        -c 'if !&exrc || !&secure | cquit | endif' \
+        -c 'qa!' 2>&1
+
     XDG_CONFIG_HOME="$EMPTY_XDG" vim -u .vimrc -i NONE -es -N \
         -c 'silent! delcommand LspStatus' \
         -c 'silent! delcommand LspInstallServer' \