Trigger.dev API keys and environment variables exposed for 0.66% of customers
On November 1, 2026, Trigger.dev disclosed a security incident in which an attacker gained unauthorized access to environment variables belonging to some customer organizations. Investigation findings released on November 6 showed that 0.66% of all customers were affected, and that the attacker had obtained root API keys to access environment variables and some run, deployment, and schedule metadata. The company blocked the attack path, revoked the relevant keys, and provided affected customers with guidance on rotating credentials and response procedures.
Key facts
- Affected organization
- Trigger.dev
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Root API keys, environment variables, and some metadata in customer environments representing 0.66% of all customers
- Cause / method
- An attacker used root API keys they had obtained to gain unauthorized access to customer environment variables and some metadata
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- Trigger.dev disclosed unauthorized access to environment variables belonging to some customer organizations and announced that it had blocked the attack path and provided affected account owners with response guidance.
- The investigation confirmed that 0.66% of all customers were affected and that root API keys had been obtained and used to access environment variables and some metadata; the company announced that it had revoked the relevant keys and provided guidance on rotating credentials.
13 related reports
- Security Disclosure: Sunday November 1st
- Trigger.dev says an attacker accessed environment variables of a subset of customer organisations
- Trigger.dev breach exposed environment variables for some orgs
- Trigger.dev discloses security incident involving exposed environment variables
- Trigger.dev's environment variable exposure, explained: what the notice says, what it leaves out, and the order to rotate your keys
- Thieves pilfer environment variables from Trigger AI workflow tool
- Cloud-hosted AI workflow tool has environment variables snatched in security incident
- Trigger.dev attacker accessed customer environment variables
- Trigger.dev says an attacker accessed environment variables of some organisations; no count or times given
- Trigger.devに不正アクセス、利用組織の一部の環境変数が窃取される — 攻撃に使われた脆弱性の悪用は遮断済み、影響先には個別に連絡
- Trigger.dev breach: check where your replacement secrets land
- Trigger.dev Security Incident (November 2026): Root API Keys and Environment Variables Accessed for 0.66% of Customers, Regenerate Keys and Rotate Secrets
- Security incident report: Sunday November 1st
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.