Trigger.dev: attacker accessed environment variables and root API keys for 0.66% of customers
Trigger.dev (hosted background jobs / AI workflows)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
On Nov 1 2026 Trigger.dev disclosed a security incident: an attacker obtained customer root API keys for some environments and used them to access environment variables. The Nov 6 incident report says 0.66% of customers were impacted, that the attacker listed recent runs/deployments/schedules in some environments, and that there is no evidence of access to other customer data, production databases, or dashboard accounts. Trigger.dev blocked the attacker, mitigated the attack vector, revoked impacted API keys, notified affected customers by email and dashboard banner, engaged IR experts, notified law enforcement, and released IP whitelisting for scoped API keys plus OIDC support. Impacted customers (emails ~21:36 UTC Nov 1 and ~20:27 UTC Nov 2) should regenerate Trigger.dev API keys and rotate credentials in affected environments. Self-hosted deployments were not impacted. The attack vector is still withheld pending the investigation. Status page marked the disclosure Resolved on Nov 6 when the full report published.
Why this severity: 0.66% of customers; root API keys and environment variables in impacted environments treated as compromised; attack vector still undisclosed
- Started
- Nov 1, 2026
Affected
- Trigger.dev cloud (subset of customer environments; self-hosted not impacted)
Fixed in
No fixed release yet
Timeline6
Hacker News threads the Nov 6 security incident report.
Trigger.dev publishes the full incident report (0.66% of customers, root API keys, run/deployment/schedule listing, no evidence of broader data access), and marks the status-page disclosure Resolved at 12:27 UTC.
~20:27 UTC: Trigger.dev sends a second email to impacted customers with environment details and credential-rotation guidance.
Trigger.dev receives infrastructure alerts for anomalous activity, identifies it as malicious, blocks the attacker and mitigates the attack vector; attacker had obtained customer root API keys and accessed environment variables for a subset of organizations.
~21:36 UTC: Trigger.dev emails impacted account owners and posts a short security disclosure; CTO Eric Allam says the exploit is blocked and environment variables were exposed for a subset of organizations.
@triggerdotdev posts that there has been a security incident, impacted account owners were emailed, and more information will follow.
Advisories3
News & write-ups1
Posts2
There has been a security incident at Trigger. We have emailed the owners of all impacted accounts. We’ll be providing more information but for now the focus is on giving the impacted account owners what they need to mitigate. trigger.dev/blog/security-incident-nov-2…
We’ve published our report on the November 1st security incident trigger.dev/blog/security-incident-repor…
Get an email when a new major security incident drops. No spam, unsubscribe any time.
