Trigger.dev confirms unauthorized access to some organizations’ environment variables

The November 6 report supersedes the initial absence of scope details: Trigger.dev says 0.66% of all customers were affected and root API keys for some environments were obtained. Those keys grant full access to environment settings, including environment variables. The percentage is not a count of people, organizations or stolen secrets. The vendor says its API-log review established scope; customers without an impact notification were unaffected, according to that assessment. Confirm uncertain delivery or account status with support.

For some environments, listing recent runs, deployments and schedules exposed run IDs, deployment IDs, schedule IDs, task names, run idempotency keys, run status, run tags, deployment metadata, deployment errors, schedule external IDs and run metadata. Trigger.dev found no evidence of other customer-data access, service access, production-database access or customer-dashboard account access. These are vendor investigation findings, not independent proof that copied credentials were never abused.

Trigger.dev says it blocked the attacker, mitigated the vector, rotated internal secrets, reviewed system and API logs, applied risk-based account restrictions, revoked affected customer API keys, engaged incident responders and notified law enforcement. It released scoped-key IP whitelisting and OIDC support. The precise vector remains withheld to protect the investigation; no public safe software version or complete exposure interval is established. Self-hosters and webhook signing secrets are explicitly excluded from this attack. The November 1 resolved status does not revoke third-party credentials; impacted customers still need issuer-side rotation and replacement-key rollout.