Trigger.dev Security Review After November 2026 Environment Variable Exposure

Trigger.dev reported an incident on November 1, 2026, in which an attacker accessed environment variables belonging to a subset of organizations using its cloud service. The variables typically store API keys, database credentials, and service tokens for workflows and background jobs. The company blocked the access the same day and contacted affected users with instructions to rotate secrets.

What Happened During the November 2026 Incident

The breach occurred on the hosted platform that runs TypeScript-based jobs and AI agent workflows. Environment variables power connections to external services such as Stripe, Supabase, and Slack. Trigger.dev maintains a public status page that logged the event as resolved by 10:50 p.m. UTC on November 1.

Public statements do not specify the number of affected organizations, the duration of access, or whether data left the system. No customer names have been released. Earlier in October, a separate Vercel sync issue had cleared some sensitive variables, but that problem was resolved before the November event.

The company operates both a cloud product and an open-source self-hosted option. Organizations including Emporio Armani, Cal.com, and GovSignals use the service for scheduled tasks and webhook handling. The November disclosure applies only to the cloud version.

Company Response and Prior Security Fixes

Trigger.dev emailed mitigation steps to impacted account owners and directed them to rotate all exposed credentials at their source services. The status page noted that further updates would appear there. As of November 3, 2026, no additional public post-mortem has been published.

Recent code releases addressed earlier vulnerabilities. Version 4.6.0 fixed an improper authorization issue in the environment variables API endpoint tracked as CVE-2026-114069. Version 4.5.9 corrected debug log exposure in the CLI. These patches were available before the November incident.

Users running the self-hosted version were not included in the disclosure. The company continues to publish release notes and security advisories on its GitHub repository and status page.

Practical Steps for Trigger.dev Users

Any organization that received an email from Trigger.dev should rotate the listed credentials immediately. This includes API keys for payment processors, database connection strings, and authentication tokens for third-party services.

Teams that have not received notification can still review their account activity logs and confirm that all environment variables remain necessary. Removing unused variables reduces the surface area for future incidents.

Organizations that rely on Trigger.dev for production workflows should maintain an inventory of every secret stored in the platform and set calendar reminders for periodic rotation. Self-hosted deployments allow full control over secret storage and network access rules.

Monitoring the official status page remains the primary channel for updates. Users should also watch for follow-up messages from the company regarding any post-incident analysis.