TRIGGER · INC-trigger-1110434 · Vendor
NO FIX YET
Trigger.dev reported a security incident in which an attacker gained unauthorized access to environment variables belonging to some customer organizations. The company says the exploit has been blocked and impacted account owners were emailed steps to mitigate.
first public Nov 1, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations whose environment variables were stored in Trigger.dev were in scope of the exposure; the sources say only a subset of organizations was impacted and do not say which. Account owners were emailed directly. Organizations with no Trigger.dev account are not affected.
Not affected if no-trigger-account
Who cares saas, secrets, security, trigger, trigger.dev
Unknown from the sources.
There has been a security incident at Trigger.dev.
We've blocked the exploit used in this attack but our investigation has identified exposure across a subset of organizations.
The attacker gained unauthorized access to environment variables for these organizations.
We have emailed all impacted account owners with steps to mitigate.
We will follow up with more details.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.