Attacker accessed customers' environment variables at developer tool Trigger.dev

On Sunday, November 1, Eric Allam, chief technology officer of Trigger.dev, published a short post on the company's blog. He wrote that an attacker had gained unauthorized access to the environment variables of some customer organizations. Trigger.dev lets developers run their applications' long-running tasks in the background. These environment variables often hold a project's most sensitive secrets: API keys, database passwords, cloud access tokens.

According to the company, the flaw that was used has been blocked. The owners of affected accounts received an email detailing the steps to take. The announcement stops there: it does not say how the attacker got in, how many organizations are affected, or since when.

At least nine developer platforms already hit in October

The story feels familiar. In late October, hosting provider Railway warned that its customers' API keys may have been read. Shortly after, hackers used AI keys that developers had entrusted to another host, Northflank. The scenario is the same each time: rather than attacking companies one by one, attackers target the platform where they store their secrets. Security firm Wiz counts at least nine developer platforms hit in October, but has found no common flaw linking these attacks.

What should you do if you use Trigger.dev?

The company's message lists no public measures. If you did not receive an email, that should mean your organization is not among those exposed. Caution is still warranted until the flaw is explained.

• Look for the email from Trigger.dev in the account owner's inbox, including spam, and follow its instructions.
• Rotate the secrets stored in your environment variables, starting with the most powerful ones: AI keys, cloud keys, database access. Then revoke the old ones.
• Monitor usage of your AI and cloud services: a runaway bill is often the first sign of a stolen key.
• Follow Trigger.dev's status page, where the company promises to publish its updates.

For now, Trigger.dev has given neither the number of affected organizations nor the method of intrusion. Yet that is what will let its customers gauge their real risk.

Update of November 14, 2026

On November 6, Trigger.dev, the platform that runs applications' background tasks, published its report on the November 1 incident. According to the company, 0.66% of its customers are affected. The attacker obtained the "root" API keys of some customer environments. These keys give full access to settings, including environment variables. In some environments, the attacker also viewed the list of runs, deployments and scheduled tasks: identifiers, task names, metadata, deployment errors.

The method of intrusion remains secret. Trigger.dev says it cannot describe it for now, in order to protect the investigation, and promises to do so later. It found no sign of access to other data, to its production databases or to customer accounts. It does not say whether the exposed secrets were used. The company revoked the API keys of affected customers, brought in incident response specialists and notified law enforcement. Self-hosted installations are not affected.

Affected customers must regenerate their Trigger.dev keys. They must also rotate, then revoke, all credentials stored in the affected environments, to be treated "as compromised." Webhook signing secrets were not exposed.