{"id":"INC-trigger-1110434","kind":"incident","aliases":[],"related":[],"title":"Trigger: Security Disclosure: Sunday November 1st","description":"There has been a security incident at Trigger.dev.\n\nWe've blocked the exploit used in this attack but our investigation has identified exposure across a subset of organizations.\n\nThe attacker gained unauthorized access to environment variables for these organizations.\n\nWe have emailed all impacted account owners with steps to mitigate.\n\nWe will follow up with more details.","summary":"Trigger.dev reported a security incident in which an attacker gained unauthorized access to environment variables belonging to some customer organizations. The company says the exploit has been blocked and impacted account owners were emailed steps to mitigate.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Trigger","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","saas","secrets","security","trigger","trigger.dev","vendor"],"not_affected_if":["no-trigger-account"],"how_to_check":"- Check your inbox for the security email from Trigger.dev sent to account owners.\n- Review the environment variables stored in your Trigger.dev projects for secrets that may have been exposed.","fix":null,"status":"open","published_at":"2026-11-01T22:50:00+00:00","first_seen_at":"2026-11-08T16:58:30+00:00","triaged_at":"2026-11-08T16:59:11+00:00","updated_at":"2026-11-08T16:59:11+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-08T16:59:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Trigger.dev: attacker read environment variables for a subset of organizations","impact":"high","summary":"Trigger.dev reported a security incident in which an attacker gained unauthorized access to environment variables belonging to some customer organizations. The company says the exploit has been blocked and impacted account owners were emailed steps to mitigate.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["trigger.dev","saas","secrets"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads environment variables containing secrets for affected organizations","analyst_note":"Sources do not say which organizations or variables were exposed or what steps were given; read the statuspage incident https://status.trigger.dev/incident/1110434 and any follow-up post.","how_to_check":"- Check your inbox for the security email from Trigger.dev sent to account owners.\n- Review the environment variables stored in your Trigger.dev projects for secrets that may have been exposed.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-trigger-account"],"who_is_affected":"Organizations whose environment variables were stored in Trigger.dev were in scope of the exposure; the sources say only a subset of organizations was impacted and do not say which. Account owners were emailed directly. Organizations with no Trigger.dev account are not affected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4543,"output_tokens":534,"severity_before":"unknown","breached_checked":true},"analyst_status":null,"analyst_note":null,"search":"'1110434':10A '1st':6A 'access':30B,88C 'account':49B,100C 'across':79C 'attack':27B,72C,85C 'belong':34B 'block':46B,66C 'compani':40B 'custom':37B 'detail':112C 'disclosur':3A 'email':52B,97C 'environ':32B,90C 'exploit':43B,68C 'exposur':78C 'follow':108C 'gain':28B,86C 'identifi':77C 'impact':48B,99C 'inc':8A 'inc-trigger':7A 'incid':12B,23B,61C 'investig':75C 'mitig':55B,105C 'novemb':5A 'organ':38B,83C,94C 'owner':50B,101C 'report':20B 'saa':13B 'say':41B 'secret':14B 'secur':2A,15B,22B,60C 'step':53B,103C 'subset':81C 'sunday':4A 'trigger':1A,9A,11A,16B 'trigger.dev':17B,19B,63C 'unauthor':29B,87C 'use':69C 'variabl':33B,91C 've':65C 'vendor':18B","nicknames":[],"mitigations":[],"who_affected":"Organizations whose environment variables were stored in Trigger.dev were in scope of the exposure; the sources say only a subset of organizations was impacted and do not say which. Account owners were emailed directly. Organizations with no Trigger.dev account are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["trigger"],"ptokens":["trigger"],"labels":["incident","saas","secrets","security","trigger","triggerdev","unknown","vendor"],"campaign_type":null,"search_a":"'1110434':10A '1st':6A 'disclosur':3A 'inc':8A 'inc-trigger':7A 'novemb':5A 'secur':2A 'sunday':4A 'trigger':1A,9A,11A","search_b":"'access':30B 'account':49B 'attack':27B 'belong':34B 'block':46B 'compani':40B 'custom':37B 'email':52B 'environ':32B 'exploit':43B 'gain':28B 'impact':48B 'incid':12B,23B 'mitig':55B 'organ':38B 'owner':50B 'report':20B 'saa':13B 'say':41B 'secret':14B 'secur':15B,22B 'step':53B 'trigger':16B 'trigger.dev':17B,19B 'unauthor':29B 'variabl':33B 'vendor':18B","search_c":"'access':88C 'account':100C 'across':79C 'attack':72C,85C 'block':66C 'detail':112C 'email':97C 'environ':90C 'exploit':68C 'exposur':78C 'follow':108C 'gain':86C 'identifi':77C 'impact':99C 'incid':61C 'investig':75C 'mitig':105C 'organ':83C,94C 'owner':101C 'secur':60C 'step':103C 'subset':81C 'trigger.dev':63C 'unauthor':87C 'use':69C 'variabl':91C 've':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-01T22:50:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"trigger:1110434","url":"https://status.trigger.dev/incident/1110434","severity":null,"published_at":"2026-11-01T22:50:00+00:00","modified_at":"2026-11-01T22:50:00+00:00","first_seen_at":"2026-11-08T16:58:30+00:00","fetched_at":"2026-11-09T02:44:16+00:00","note":null}],"documents":[],"disclosures":[{"company":"Trigger","domain":"status.trigger.dev","url":"https://status.trigger.dev/incident/1110434","kind":"statuspage","published_at":"2026-11-01T22:50:00+00:00","quote":"The attacker gained unauthorized access to environment variables for these organizations.","confidence":0.9700000286102295,"source":"statuspage","created_at":"2026-11-08T17:12:30+00:00","entry":"unknown"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}