{"id":"INC-trigger-1083239","kind":"incident","aliases":[],"related":[],"title":"Trigger: Some sensitive environment variables synced from Vercel were cleared","description":"Between 12:21 and 15:09 UTC, deploying with the Vercel integration overwrote some environment variables with empty values in Trigger.dev. Projects with affected variables may see failing deploys or runs that error because of missing credentials.\n\nYou are only affected if all of these are true:\n- Your project uses the Vercel integration with environment variable syncing enabled\n- The project has environment variables marked as Sensitive in Vercel\n- That project deployed between 12:21 and 15:09 UTC today\n\nIf any of these don't apply, your project was not affected and you don't need to do anything. Only the environments that deployed in that window are affected.\n\nThe cause has been fixed and no new variables are being cleared. Variables that were already cleared are still empty: redeploying will not restore them. We are working on restoring them, and we are contacting affected customers directly with the list of impacted projects and variables.\n\nIf you can't wait, re-entering the values in the Trigger.dev dashboard under Environment Variables fixes the affected project right away.","summary":null,"severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Trigger","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","ops","security","trigger","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-06T12:21:00+00:00","first_seen_at":"2026-11-08T16:58:30+00:00","triaged_at":"2026-11-08T16:59:06+00:00","updated_at":"2026-11-08T16:59:06+00:00","category":"vendor","confidence":null,"triage":{"breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'09':26C,97C '1083239':14A '12':22C,93C '15':25C,96C '21':23C,94C 'affect':44C,61C,111C,129C,165C,195C 'alreadi':145C 'anyth':119C 'appli':106C 'away':198C 'caus':131C 'clear':10A,141C,146C 'contact':164C 'credenti':57C 'custom':166C 'dashboard':189C 'deploy':28C,49C,91C,124C 'direct':167C 'empti':38C,149C 'enabl':78C 'enter':183C 'environ':4A,35C,75C,82C,122C,191C 'error':53C 'fail':48C 'fix':134C,193C 'impact':172C 'inc':12A 'inc-trigger':11A 'incid':16B 'integr':32C,73C 'list':170C 'mark':84C 'may':46C 'miss':56C 'need':116C 'new':137C 'op':17B 'overwrot':33C 'project':42C,69C,80C,90C,108C,173C,196C 're':182C 're-ent':181C 'redeploy':150C 'restor':153C,159C 'right':197C 'run':51C 'secur':18B 'see':47C 'sensit':3A,86C 'still':148C 'sync':6A,77C 'today':99C 'trigger':1A,13A,15A,19B 'trigger.dev':41C,188C 'true':67C 'use':70C 'utc':27C,98C 'valu':39C,185C 'variabl':5A,36C,45C,76C,83C,138C,142C,175C,192C 'vendor':20B 'vercel':8A,31C,72C,88C 'wait':180C 'window':127C 'work':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["trigger"],"ptokens":["trigger"],"labels":["incident","ops","security","trigger","unknown","vendor"],"campaign_type":null,"search_a":"'1083239':14A 'clear':10A 'environ':4A 'inc':12A 'inc-trigger':11A 'sensit':3A 'sync':6A 'trigger':1A,13A,15A 'variabl':5A 'vercel':8A","search_b":"'incid':16B 'op':17B 'secur':18B 'trigger':19B 'vendor':20B","search_c":"'09':26C,97C '12':22C,93C '15':25C,96C '21':23C,94C 'affect':44C,61C,111C,129C,165C,195C 'alreadi':145C 'anyth':119C 'appli':106C 'away':198C 'caus':131C 'clear':141C,146C 'contact':164C 'credenti':57C 'custom':166C 'dashboard':189C 'deploy':28C,49C,91C,124C 'direct':167C 'empti':38C,149C 'enabl':78C 'enter':183C 'environ':35C,75C,82C,122C,191C 'error':53C 'fail':48C 'fix':134C,193C 'impact':172C 'integr':32C,73C 'list':170C 'mark':84C 'may':46C 'miss':56C 'need':116C 'new':137C 'overwrot':33C 'project':42C,69C,80C,90C,108C,173C,196C 're':182C 're-ent':181C 'redeploy':150C 'restor':153C,159C 'right':197C 'run':51C 'see':47C 'sensit':86C 'still':148C 'sync':77C 'today':99C 'trigger.dev':41C,188C 'true':67C 'use':70C 'utc':27C,98C 'valu':39C,185C 'variabl':36C,45C,76C,83C,138C,142C,175C,192C 'vercel':31C,72C,88C 'wait':180C 'window':127C 'work':157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-06T12:21:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"trigger:1083239","url":"https://status.trigger.dev/incident/1083239","severity":null,"published_at":"2026-10-06T12:21:00+00:00","modified_at":"2026-10-06T12:21:00+00:00","first_seen_at":"2026-11-08T16:58:30+00:00","fetched_at":"2026-11-09T01:47:28+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}