On November 1, 2026, we became aware of a security incident which impacted some of our customers. This included unauthorized access to environment variables. This impacted 0.66% of all customers.
We took action to contain and remediate the incident and notified all impacted customers.
We have engaged cybersecurity incident response experts and notified law enforcement.
This is a follow-up to our original security disclosure.
What happened?
On November 1, 2026, we received infrastructure alerts triggered by anomalous activity. We quickly identified that this activity was malicious and we blocked the attacker and mitigated the attack vector.
We are unable to comment on the specific attack vector currently to ensure that we protect our investigation and our customers. However, we will aim to share the attack vector when we believe we can do so responsibly.
The attacker obtained Trigger.dev customer root API keys for some customer environments. A customer root API key gives full access to that environment’s settings, including its environment variables.
We identified that in some customer environments, the attacker listed recent runs, deployments and schedules. These calls return data that includes: run IDs, deployment IDs, schedule IDs, task names, run idempotency keys, run status, run tags, deployment metadata, deployment error, schedule external id, and run metadata.
We found no evidence that the attacker accessed any other customer data, any services, any of our production databases, or any customer dashboard accounts.
We have contacted all affected customers by email and through the dashboard, with details of the environments involved and guidance on rotating their credentials.
We also proactively revoked any potentially impacted Trigger.dev API keys for all impacted environments.
What should you do?
If you are a Trigger.dev customer, please check if you were affected by this incident:
- Impacted customers will have received an email from us on November 1 at approximately 21:36 UTC and again on November 2 at 20:27 UTC.
- Impacted customers will see a notification banner in their Trigger.dev dashboard.
The notifications outline which environments were affected. Please treat the credentials in those environments as compromised.
If you have not received an impact notification, your organization was not affected.
For impacted customers, we recommend taking the following steps:
- Regenerate your Trigger.dev API keys. All exposed Trigger.dev API keys have now been revoked. We emailed you with specific instructions on how to regenerate your keys.
- Rotate credentials in the affected environments. This includes database passwords, third-party API keys and access tokens. We recommend that you revoke the previous credentials with their respective providers.
If you have questions or need help rotating credentials, email [email protected] from your account email. We're prioritizing support related to this incident.
What have we done?
We have taken the following actions:
- Removed the attacker's access to our systems and mitigated the attack vector.
- Rotated our own internal credentials and secrets as a precaution.
- Reviewed API access logs across all customer environments to confirm the scope of impact.
- Reviewed all logs across all systems to identify all suspicious activity.
- Notified affected customers directly, with details of the exposed environments and recommended actions.
- Risk based automated account restrictions.
- Proactively revoked all affected customers’ Trigger.dev API keys.
- Engaged cybersecurity incident response experts to further our understanding of the incident.
- Notified law enforcement.
- Released IP whitelisting for scoped API keys.
- Released OIDC support.
We will continue to roll out further changes focused on increasing defense in depth across our infrastructure as well as improving methods of early detection.
FAQ
Were my environment variables exposed?
If you have not received an impact notification, your organization was not affected.
You can check if you were affected by this incident:
- Impacted customers will have received an email from us on November 1 at approximately 21:36 UTC and again on November 2 at 20:27 UTC.
- Impacted customers will see a notification banner in your Trigger.dev dashboard.
If you would like us to verify your account's status, contact [email protected].
Are Trigger.dev's stored environment variables encrypted?
Yes, we follow industry best practices by storing all environment variables encrypted at rest. They are decrypted just-in-time for run execution.
I run a self-hosted deployment, is there anything I should do?
Self-hosters were not impacted by this attack. Nevertheless for all self-hosters, we recommend running in single tenant mode by setting WHITELISTED_EMAILS to only accounts you control.
Do I need to rotate the signing secrets of my Trigger.dev webhooks?
No. Webhook signing secrets were not exposed and do not need to be rotated.