Trigger.dev security incident: rotate your job secrets now
Trigger.dev says an attacker reached environment variables for a subset of orgs on November 1. Second env-var breach in two weeks. Rotate and cap keys now.
If you run background jobs on Trigger.dev, check your inbox before you do anything else. In a security disclosure dated November 1, CTO Eric Allam says an attacker got unauthorized access to environment variables for a subset of organizations. This Trigger.dev security incident lands less than two weeks after Railway disclosed the same class of breach. That is a pattern, not bad luck.
What actually happened
The disclosure is short. Here is everything it confirms:
- An attacker used an exploit to reach environment variables belonging to "a subset of organizations."
- Trigger.dev says it has blocked the exploit.
- Its investigation identified which organizations were exposed, and it emailed every impacted account owner with mitigation steps.
- Updates go to the Trigger.dev status page.
Here is what the disclosure does not say: how many organizations were hit, how the attacker got in, which environments (dev, staging or prod) were involved, or which secrets to rotate. We are not going to guess. If you did not get an email, that is a good sign. It is not proof. Watch the status page for the full report.
Why the Trigger.dev security incident matters for your business
Job runners hold your most dangerous keys. A background job platform is where the real work happens: charging cards, syncing orders, calling model APIs, writing to your database. So its env panel tends to hold your Stripe secret, your database URL and your AI provider keys, all in one place. One exploit on the platform reads all of them.
Two platforms, two weeks, same target. Railway's October breach went after environment variables and AI API keys. Now Trigger.dev reports environment variable access. If your secrets live in a vendor's dashboard and nowhere else, your security depends on theirs.
Rotate first, read the report second. Even if you were not emailed, rotating the keys your Trigger.dev tasks use costs you an hour. A leaked Stripe or model key costs a lot more. Put hard spend caps on every AI key while you are in there.
Key takeaways
- Trigger.dev says an attacker reached environment variables for a subset of organizations, disclosed November 1
- The exploit is blocked and impacted account owners were emailed mitigation steps
- No count, root cause or affected environments have been published yet
- Rotate the secrets your jobs use anyway, starting with payment, database and AI keys
- Set spend caps and usage alerts on every model provider key
Your job runner should not be your key vault. We move secrets into a manager you control, scope each key to the one job that needs it, and set caps on your AI spend, so a vendor breach means a short rotation, not a lost week. Ask us for a secrets review, or see how we build.
Sources: Trigger.dev: Security Disclosure, Sunday November 1st, Trigger.dev status page.
- #trigger.dev
- #security breach
- #environment variables
- #secrets management
- #background jobs
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Microsoft: North Korean hackers run AI across hiring scams
Microsoft says North Korean hackers use AI for fake recruiters, AI-built resumes and trojanized private GitHub repos. How a small team vets hires and locks repos.
Read itIvanti Connect Secure: two more zero-days, patch again
Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 completed a root exploit chain. Fixes are 25.1.1.3 and 22.8R2.6. Last month's patch is not enough.
Read it