Trigger.dev API keys and environment variables exposed for 0.66% of customers
On 1 November 2026, Trigger.dev disclosed a security incident in which an attacker gained unauthorised access to environment variables belonging to some customer organisations. Investigation findings released on 6 November showed that 0.66% of all customers were affected, and that the attacker had obtained root API keys to access environment variables and some run, deployment and schedule metadata. The company blocked the attack path, revoked the relevant keys and provided affected customers with guidance on rotating credentials and response procedures.
Key facts
- Affected organisation
- Trigger.dev
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Root API keys, environment variables and some metadata in customer environments representing 0.66% of all customers
- Cause / method
- An attacker used root API keys they had obtained to gain unauthorised access to customer environment variables and some metadata
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- Trigger.dev disclosed unauthorised access to environment variables belonging to some customer organisations and announced that it had blocked the attack path and provided affected account owners with response guidance.
- The investigation confirmed that 0.66% of all customers were affected and that root API keys had been obtained and used to access environment variables and some metadata; the company announced that it had revoked the relevant keys and provided guidance on rotating credentials.
13 related reports
- Security Disclosure: Sunday November 1st
- Trigger.dev says an attacker accessed environment variables of a subset of customer organisations
- Trigger.dev breach exposed environment variables for some orgs
- Trigger.dev discloses security incident involving exposed environment variables
- Trigger.dev's environment variable exposure, explained: what the notice says, what it leaves out, and the order to rotate your keys
- Thieves pilfer environment variables from Trigger AI workflow tool
- Cloud-hosted AI workflow tool has environment variables snatched in security incident
- Trigger.dev attacker accessed customer environment variables
- Trigger.dev says an attacker accessed environment variables of some organisations; no count or times given
- Trigger.devに不正アクセス、利用組織の一部の環境変数が窃取される — 攻撃に使われた脆弱性の悪用は遮断済み、影響先には個別に連絡
- Trigger.dev breach: check where your replacement secrets land
- Trigger.dev Security Incident (November 2026): Root API Keys and Environment Variables Accessed for 0.66% of Customers, Regenerate Keys and Rotate Secrets
- Security incident report: Sunday November 1st
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.