Trigger.dev customer environment variables exposed
The gist
Trigger.dev said an attacker gained unauthorized access to environment variables for a subset of organizations.
Customers may need to rotate API keys and database credentials stored in those variables.
How it unfolded
- Nov 1, 2026Trigger.dev disclosed a security incident in which an attacker gained unauthorized access to environment variables for a subset of organizations; it said it blocked the exploit and emailed all impacted account owners with mitigation steps.
- Nov 1, 2026 22:50 UTCTrigger.dev's status page marked the API incident resolved.
- Nov 2, 2026The disclosure was posted and discussed on Hacker News and shared on X by Hacker News 50.