trigger.dev Reports Unauthorized Access to Customer Environment Variables
Not actionable yet. Worth tracking in case it lands.
On November 1, 2026, Trigger.dev suffered a security incident where an attacker accessed environment variables belonging to a subset of customer organizations.
Users of this background job framework may have had their OpenAI or Anthropic keys stolen, requiring immediate rotation to prevent budget drain.
This incident highlights the centralized risk of 'agentic' infrastructure that must store high-privilege keys. Builders should move toward short-lived tokens or OIDC where possible to mitigate the impact of platform-level breaches.
The post-mortem report detailing the specific entry vector the attacker used.
- Compromised environment variables may expose sensitive API keys for services like OpenAI or Anthropic.
- Impacted users are advised to immediately rotate all API keys associated with the platform.
- Security incident highlights the risks of storing third-party service credentials in background job frameworks.
The platform acknowledged the security breach, confirmed the unauthorized access, and is notifying affected customers.