AI Workflow Platform Trigger.dev Discloses Security Incident Involving Unauthorized Access to Customer Environment Variables
Trigger.dev confirms attackers accessed customer environment variables, potentially exposing API keys. The company has blocked the attack vector and notified users, but details on the method and scope remain undisclosed.
Open-source AI workflow execution platform Trigger.dev disclosed a security incident on November 1, confirming that attackers gained unauthorized access to environment variables within some customer organizations. The company stated it has blocked the attack vector and emailed affected customers with remediation steps, but as of the report, it has not publicly disclosed the specific attack method, the number of affected organizations, or the contents of the accessed variables.
Trigger.dev allows developers to build background tasks, schedules, and AI agents using TypeScript. In development practices, environment variables are commonly used to store API keys, access tokens, and database connection passwords to verify programs when connecting to cloud services or third-party interfaces. If attackers obtained these valid credentials, they could potentially gain further access to external services connected by customers.
According to Trigger.dev's technical documentation, developers can mark sensitive configurations as "Secret" so they do not appear in the management interface after creation. It remains unclear whether the attackers successfully accessed such encrypted Secret variables or what specific pathway they used to obtain the related data.
Trigger.dev CTO Eric Allam stated in the incident announcement that investigations found some customer organizations were affected. The official status page marked the incident as "Resolved," listing the API as an impacted service, with the resolution time set for 6:50 AM Taiwan Time on November 2. The company promised to publish more incident details subsequently.