Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables belonging to a subset of organizations using its hosted workflow platform. In its security disclosure, the company said it had blocked the exploit and emailed affected account owners with mitigation steps. Its status page marked the incident resolved at 22:50 UTC that day.
Environment variables can contain API keys, database credentials and tokens used by connected services. Trigger.dev has not said how many organizations were affected, which variables were accessed, when the intrusion began or whether any exposed credentials were misused. The company said it would provide further updates but did not include technical details in its initial notice.
The Register reported on November 2 that Trigger declined to provide additional details and pointed reporters to a forthcoming incident report. The disclosure came shortly after a similar secrets exposure at Northflank, which told customers to treat stored environment variables as compromised.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Trigger.dev Says Attacker Accessed Customer Environment Variables
