Trigger.dev breach exposed environment variables for some orgs
An attacker got unauthorised access to environment variables for a subset of customers on 1 November, the third developer platform breach of its kind in under two weeks.
Trigger.dev disclosed a security incident on 1 November: an attacker got unauthorised access to environment variables for a subset of its customer organisations. CTO Eric Allam posted the disclosure on the company blog, and the status page shows the incident resolved by 22:50 UTC that day.
Trigger.dev runs background jobs, scheduled tasks and AI agent workflows for TypeScript teams, so the environment variables it stores typically hold API keys for providers like OpenAI, Anthropic and Stripe, alongside database credentials. The company says it has blocked the exploit used in the attack and emailed every affected account owner with mitigation steps, but it hasn’t said how many organisations were hit or how the attacker got in.
Why it matters: this is the third disclosed breach of a developer platform’s stored secrets in under two weeks, after Railway on 22 October and Northflank on 30 October. If you run anything on Trigger.dev, rotate every key and credential stored there now rather than waiting for a direct email, and check your AI provider and Stripe billing logs for activity you didn’t generate.
The caveat: Trigger.dev hasn’t disclosed the vulnerability itself, a timeline, or a customer count, so there’s no way to confirm from the outside whether you were affected beyond checking your inbox and the status page directly.