Trigger.dev Breach Exposes Customer Environment Variables and Potential Secrets

Trigger.dev disclosed that an attacker gained unauthorized access to environment variables belonging to a subset of organizations using its cloud-hosted AI workflow platform. The company said it blocked the exploitation method and emailed administrators of all accounts identified as affected with protective instructions. Environment variables can hold API keys, database credentials, authentication tokens, and other secrets, but Trigger.dev has not specified which credential types were exposed.

The number and identities of affected organizations, intrusion timeline, technical cause, and attacker identity remain undisclosed. Trigger.dev declined further comment pending a full incident report. Exposed secrets could allow unauthorized access to connected services until revoked or replaced, making credential rotation and review of connected-service activity priorities for affected customers. No downstream customer compromise or fraudulent use of AI service keys has been publicly confirmed.