{
  "id": "trigger-dev-environment-secrets",
  "url": "https://ohshit.app/incidents/trigger-dev-environment-secrets/",
  "title": "Trigger.dev confirms unauthorized access to some organizations’ environment variables",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-01",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Trigger.dev",
    "cloud",
    "credentials"
  ],
  "ecosystems": [],
  "summary": "Trigger.dev says an attacker accessed environment variables for a subset of organizations. It says the exploit is blocked and affected account owners have been emailed, but has not published a root cause or organization count. Platform recovery does not revoke exposed third-party credentials.",
  "splash": "A subset of Trigger.dev organizations’ environment variables; the vendor has contacted affected account owners",
  "wipe": "Review the owner notice, revoke and replace exposed secrets at their issuers, then update dependent tasks and integrations",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Have account owners check their incident email",
      "hint": "Trigger.dev says all impacted account owners received mitigation steps. Review that notice through established account/support channels; check affected organizations and task environments. A missing message or operational status alone is not proof that your secrets were safe."
    },
    {
      "title": "Revoke exposed credentials at the issuing service",
      "hint": "If the affected environment held API keys, database credentials or other secrets, disable or rotate them at the issuer, update Trigger.dev and dependent integrations, and verify tasks use replacements. Editing an environment variable or seeing the platform resolved does not invalidate a copied credential. Follow the owner notice for incident-specific steps."
    },
    {
      "title": "Review downstream access and preserve evidence",
      "hint": "Retain the owner notification, relevant task history, provider authentication/usage logs and billing records. Investigate unexpected use of exposed credentials and contact Trigger.dev through its established support route. The public disclosure supplies no detection indicator list or safe exposure cutoff."
    }
  ],
  "sources": [
    {
      "name": "Trigger.dev CTO disclosure",
      "url": "https://trigger.dev/blog/security-incident-nov-2026",
      "primary": true
    },
    {
      "name": "Trigger.dev full incident status entry",
      "url": "https://status.trigger.dev/incident/1110434?mp=true",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Trigger.dev confirms attacker access to environment variables.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 1, 2026",
      "title": "Trigger.dev discloses environment-variable exposure"
    },
    {
      "date": "Nov 1, 22:50 UTC",
      "title": "Status notice marked resolved; exploit blocked and owners contacted",
      "body": "The notice promises further details; it does not publish a root cause, exposure window or affected-organization count."
    }
  ],
  "body_markdown": "The disclosure confirms unauthorized access rather than just a theoretical vulnerability. It does not establish that every organization was affected or that every stored value was taken. Neither the short CTO post nor the status entry identifies the entry point, affected release, victim count or exposure interval. No public fixed version is given, and the announcement does not establish an equivalent flaw in self-hosted installations.\n\nThe vendor’s resolved status describes its response, not an independent finding that copied secrets have stopped working. Credential rotation and review of connected services remain the account owner’s recovery work."
}