Trigger.dev says an attacker read environment variables for a subset of customer organizations
AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It says the exploit is blocked and affected owners were emailed, but has not said how it happened or how many customers were hit.
Trigger.dev, an open-source platform for building AI agents and background workflows in TypeScript, posted a security disclosure on its status page on November 1 saying "there has been a security incident at Trigger.dev" and that "the attacker gained unauthorized access to environment variables" for "a subset of organizations." The company said the exploit has been blocked and that it has "emailed all impacted account owners with steps to mitigate." It has not said how the attacker got in, how many organizations were affected or which variables were read. When The Register asked for more on November 2, Trigger.dev declined and said to wait for a full incident report. As of November 5 the status entry, marked resolved, promises more details but carries no follow-up.
Why it matters
This is the fourth developer platform in three weeks to lose customer environment variables, after Zeabur, Railway and Northflank. On a workflow platform those variables are the API keys for every service a task calls, and The Register notes Trigger.dev recently added webhook support for Stripe, Supabase and Slack. Each one is a static credential that works from anywhere until it is rotated: the static API key abuse pattern.
If you run tasks on Trigger.dev's cloud service, rotate every secret stored there even if you did not get the email, because the affected subset is not public. Then check the downstream providers' logs for calls from unfamiliar addresses since late October. Longer term, move what you can to short-lived credentials through workload identity federation, so the platform holds nothing worth stealing. Our secrets management guide covers rotation.
Source: Trigger.dev status page, The Register
Related on Start with Identity
- BlogZeabur to shut down after a non-expiring admin token opened its shared cluster
Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private c
- BlogOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organi
- BlogDigiCert says self-registered accounts read archived customer data, including some ID documents
DigiCert is notifying customers that an unauthorized, self-registered account read archived customer records from an internal business system between June 27 an
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto