# Trigger.dev: attacker accessed environment variables and root API keys for 0.66% of customers · pwn.watch > On Nov 1 2026 Trigger.dev disclosed a security incident: an attacker obtained customer root API keys for some environments and used them to access environment variables. The Nov 6 incident report says 0.66% of customers were impacted, that the attacker listed recent runs/deployments/schedules in some environments, and that there is no evidence of access to other customer data, production databases, or dashboard accounts. Trigger.dev blocked the attacker, mitigated the attack vector, revoked impacted API keys, notified affected customers by email and dashboard banner, engaged IR experts, notified law enforcement, and released IP whitelisting for scoped API keys plus OIDC support. Impacted customers (emails ~21:36 UTC Nov 1 and ~20:27 UTC Nov 2) should regenerate Trigger.dev API keys and rotate credentials in affected environments. Self-hosted deployments were not impacted. The attack vector is still withheld pending the investigation. Status page marked the disclosure Resolved on Nov 6 when the full report published. Page: https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026 · generated 2026-11-07T03:50:23.863Z ## Status - Severity: high · status: live · patch: partial - Product: Trigger.dev (hosted background jobs / AI workflows) - Started: 2026-11-01 - Affected: Trigger.dev cloud (subset of customer environments; self-hosted not impacted) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026.json - This file: https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026/llms.txt ## Updates (newest first) - 2026-11-07: Hacker News threads the Nov 6 security incident report. (https://news.ycombinator.com/item?id=50401113) - 2026-11-06: Trigger.dev publishes the full incident report (0.66% of customers, root API keys, run/deployment/schedule listing, no evidence of broader data access), and marks the status-page disclosure Resolved at 12:27 UTC. (https://trigger.dev/blog/security-incident-report-nov-2026) - 2026-11-02: ~20:27 UTC: Trigger.dev sends a second email to impacted customers with environment details and credential-rotation guidance. (https://trigger.dev/blog/security-incident-report-nov-2026) - 2026-11-01: Trigger.dev receives infrastructure alerts for anomalous activity, identifies it as malicious, blocks the attacker and mitigates the attack vector; attacker had obtained customer root API keys and accessed environment variables for a subset of organizations. (https://trigger.dev/blog/security-incident-report-nov-2026) - 2026-11-01: ~21:36 UTC: Trigger.dev emails impacted account owners and posts a short security disclosure; CTO Eric Allam says the exploit is blocked and environment variables were exposed for a subset of organizations. (https://trigger.dev/blog/security-incident-nov-2026) - 2026-11-01: @triggerdotdev posts that there has been a security incident, impacted account owners were emailed, and more information will follow. (https://x.com/triggerdotdev/status/2117039160926392721) ## Fix brief # Security brief: Trigger.dev: attacker accessed environment variables and root API keys for 0.66% of customers Source: https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026 · status: live · severity: high · updated Nov 7, 2026, 03:46 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Nov 1 2026 Trigger.dev disclosed a security incident: an attacker obtained customer root API keys for some environments and used them to access environment variables. The Nov 6 incident report says 0.66% of customers were impacted, that the attacker listed recent runs/deployments/schedules in some environments, and that there is no evidence of access to other customer data, production databases, or dashboard accounts. Trigger.dev blocked the attacker, mitigated the attack vector, revoked impacted API keys, notified affected customers by email and dashboard banner, engaged IR experts, notified law enforcement, and released IP whitelisting for scoped API keys plus OIDC support. Impacted customers (emails ~21:36 UTC Nov 1 and ~20:27 UTC Nov 2) should regenerate Trigger.dev API keys and rotate credentials in affected environments. Self-hosted deployments were not impacted. The attack vector is still withheld pending the investigation. Status page marked the disclosure Resolved on Nov 6 when the full report published. Severity detail: 0.66% of customers; root API keys and environment variables in impacted environments treated as compromised; attack vector still undisclosed - Product: Trigger.dev (hosted background jobs / AI workflows) ## Affected versions - Trigger.dev cloud (subset of customer environments; self-hosted not impacted) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use Trigger.dev cloud: check email from Nov 1 (~21:36 UTC) / Nov 2 (~20:27 UTC) and the dashboard banner. Impacted environments: regenerate Trigger.dev API keys (exposed ones were revoked) and rotate every credential stored there (DB passwords, third-party API keys, tokens) at the issuing provider. Self-hosted was not impacted. Webhook signing secrets were not exposed. ## Latest updates - Nov 7, 2026: Hacker News threads the Nov 6 security incident report. - Nov 6, 2026: Trigger.dev publishes the full incident report (0.66% of customers, root API keys, run/deployment/schedule listing, no evidence of broader data access), and marks the status-page disclosure Resolved at 12:27 UTC. - Nov 2, 2026: ~20:27 UTC: Trigger.dev sends a second email to impacted customers with environment details and credential-rotation guidance. - Nov 1, 2026: Trigger.dev receives infrastructure alerts for anomalous activity, identifies it as malicious, blocks the attacker and mitigates the attack vector; attacker had obtained customer root API keys and accessed environment variables for a subset of organizations. - Nov 1, 2026: ~21:36 UTC: Trigger.dev emails impacted account owners and posts a short security disclosure; CTO Eric Allam says the exploit is blocked and environment variables were exposed for a subset of organizations. - Nov 1, 2026: @triggerdotdev posts that there has been a security incident, impacted account owners were emailed, and more information will follow. ## Advisories - [Security incident report: Sunday November 1st](https://trigger.dev/blog/security-incident-report-nov-2026) (Trigger.dev) - [Security Disclosure: Sunday November 1st](https://trigger.dev/blog/security-incident-nov-2026) (Trigger.dev) - [Security Disclosure: Sunday November 1st (status)](https://status.trigger.dev/incidents) (Trigger.dev) ## Write-ups & news - [Trigger.dev: Security incident report – Sunday November first](https://news.ycombinator.com/item?id=50401113) --- Machine-readable: https://pwn.watch/i/trigger-dev-env-vars-api-keys-breach-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.