Trigger.dev says an attacker read environment variables of some customers

Serguey Asael Shinder02 November 2026, 08:401 min read

Trigger.dev published a security notice at 22:33 UTC on 1 November. It says the company has blocked the exploit used in the attack, but that its investigation found exposure across a subset of organisations: the attacker gained unauthorised access to the environment variables those organisations had stored on the platform.

The company says it has emailed every affected account owner with mitigation steps and will post further updates on its status page, where the event is listed as "Security Disclosure: Sunday November 1st". The notice does not say how the attacker got in, how many organisations are affected, or over what period the access took place.

What it means

On a job platform, environment variables are where the secrets live: API keys, database URLs, tokens for the services a job calls. If a team received the email, the variables listed in it should be treated as known to a third party, which means rotating each credential at its issuer rather than only editing it in the dashboard. Teams that did not get the email have no stated reason to act, but checking the access logs of the services those keys unlock costs little while the scope of the incident is still unpublished.