Trigger.dev Breach Exposes Env Vars: Are Your Secrets Already Out?

Trigger.dev says an attacker got into environment variables for a subset of organizations. Here's what leaked, what's still unknown, and what to rotate now.

TheTechLane cover: Trigger.dev breach exposes env vars, are your secrets already out? An open black padlock with the TL logo in front of a redacted .env file of API keys

Trigger.dev, the platform developers use to run background jobs and AI agents, says an attacker gained unauthorized access to customer environment variables on Sunday, November 1. The company says it has blocked the exploit, but it hasn't said how many organizations were hit, how the attacker got in, or how long they had access.

Here's what you need to know:

  • An attacker accessed environment variables for "a subset of organizations" on Trigger.dev, the company disclosed on November 1, 2026.

  • Trigger.dev says it has blocked the exploit and emailed every impacted account owner with steps to mitigate.

  • The root cause, the number of affected organizations, and whether stolen secrets were used have not been disclosed.

  • It lands days after Northflank told customers to assume all of their environment variables had been decrypted.

UML sequence diagram of what Trigger.dev has disclosed about its November 1, 2026 breach: an attacker used an exploit that has not been disclosed against the Trigger.dev API, gained unauthorized access to environment variables for a subset of organizations, Trigger.dev blocked the exploit, emailed every impacted account owner with mitigation steps, and posted the incident on its status page at 10:50 p.m. UTC, with a follow-up on root cause and scope still pending

What Trigger.dev has disclosed about the breach so far

What Happened

In a short post titled "Security Disclosure: Sunday November 1st," Trigger.dev CTO Eric Allam wrote: "There has been a security incident at Trigger.dev." According to Trigger.dev's official security disclosure, the company has "blocked the exploit used in this attack, but our investigation has identified exposure across a subset of organizations."

The key line is blunt: "The attacker gained unauthorized access to environment variables for these organizations." Trigger.dev says it has emailed all impacted account owners with mitigation steps and will publish updates on its status page.

The same notice appears on Trigger.dev's status page incident report, which lists the API as the affected service and shows the incident marked resolved on November 1, 2026 at 10:50 p.m. UTC. The status page entry adds: "We will follow up with more details."

That follow-up hasn't landed yet. As RuntimeWire's report on the incident notes, the company has not said how many organizations were affected. TechCortex and LavX News also report that Trigger.dev hasn't named the vulnerability the attacker used.

Why It Matters

Environment variables are where the keys to everything live. On a platform like Trigger.dev, they're how deployed tasks get database URLs, AI provider keys, webhook secrets and third-party tokens. Trigger.dev's environment variables docs explain why: because the platform deploys and scales your tasks, any variable your code uses has to be accessible to Trigger.dev so it can run.

That's the trade-off of every managed runtime. You hand the platform your secrets so it can run your code, and a breach of the platform becomes a breach of everything those secrets unlock.

And this isn't an isolated pattern. Just days earlier, cloud host Northflank disclosed a breach in which customer environment variables were decrypted, followed by reports of unauthorized use of customers' AI API keys, as Root2Sec's summary of the Northflank breach lays out. We covered that one in Northflank Breach Exposes AI Keys: Have You Rotated Your Secrets Yet? Trigger.dev hasn't said whether its incident is connected, so there's no evidence yet that the two are linked. But the target is the same: the place developers keep their production secrets.

What It Means for Developers

If you got an email from Trigger.dev, treat every secret in the affected organization as compromised. If you didn't, it's still worth an audit, because you won't know the full scope until Trigger.dev publishes more.

  • Rotate, don't just review. Generate new API keys, database passwords and tokens for anything stored in Trigger.dev environment variables, then revoke the old ones at the provider.

  • Start with the expensive keys. AI provider keys, cloud credentials and payment keys can run up bills or open other systems fast. The Northflank incident showed how quickly stolen AI keys get used.

  • Check the other side. Look at usage dashboards and access logs at OpenAI, Anthropic, AWS, your database host and others for activity you don't recognize in recent days.

  • Update deploys after rotating. New values need to go into the Trigger.dev dashboard (Dev, Staging and Prod as relevant) and any synced sources, then redeploy so tasks pick them up.

  • Scope keys tighter going forward. Use per-environment, least-privilege keys with spend limits where providers allow it, so one leaked variable can't unlock everything.

Flowchart for teams with secrets in Trigger.dev environment variables: if you got Trigger.dev's incident email, treat every secret in that organization as compromised, and if not, audit anyway until the full scope is published; then rotate AI, cloud and payment keys first, revoke old keys at each provider, check provider usage and access logs, update values in the dashboard and redeploy, and scope new keys per environment with least privilege and spend limits

A five-step secret rotation checklist

What's Next

The big open questions are the ones Trigger.dev has promised to answer in its follow-up: what the exploit was, when the attacker first got in, how many organizations were exposed, and whether any of the stolen values have been used.

Watch the Trigger.dev status page for the post-incident details. If the root cause turns out to be shared with other hosted platforms, expect more providers to audit how they store and decrypt customer secrets.

FAQ

Was my Trigger.dev account affected?

Trigger.dev says it emailed all impacted account owners with steps to mitigate. If you haven't received that email, the company hasn't flagged your organization, but it hasn't published the full scope either.

What exactly was exposed?

According to the company, the attacker gained unauthorized access to environment variables for a subset of organizations. Trigger.dev hasn't said whether anything else, such as code or run data, was accessed.

Is this connected to the Northflank breach?

There's no public evidence of a link. Both incidents involve hosted platforms and customer environment variables, but Trigger.dev hasn't disclosed its root cause.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.