--- title: Trigger.dev customer environment variables exposed description: An attacker gained unauthorized access to environment variables for a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used in... canonical: https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Trigger.dev customer environment variables exposed | daily.dev og:description: An attacker gained unauthorized access to environment variables for a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used in... og:url: https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89 og:image: https://api.daily.dev/og/posts/agq3fDT89.png og:image:alt: Trigger.dev customer environment variables exposed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Trigger.dev customer environment variables exposed **[Hacker News](https://daily.dev/sources/hn)** · 1 min read · 0 upvotes · 0 comments ## Summary An attacker gained unauthorized access to environment variables for a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used in the attack. Impacted account owners have been emailed with steps to mitigate the exposure. Further updates will be posted on the company's status page. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened in the Trigger.dev security incident in November 2026? An attacker gained unauthorized access to environment variables belonging to a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used to carry out the attack and emailed all impacted account owners with steps to mitigate the exposure. Further updates are being posted to Trigger.dev's status page. _Teams relying on Trigger.dev for secrets can track incident response news like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 73 comments across hackernews (as of 2026-11-02). **TL;DR:** Most commenters are angry that the incident was marked 'resolved' with so little detail, arguing that exposing customer secrets shouldn't be closed out until a postmortem and remediation are done, while a smaller group defends the vendor as having done what it reasonably could. **Sentiment:** 2% positive · 28% mixed · 70% skeptical **The case for** - A few argue the company acted reasonably: patched the exploit, emailed affected customers directly, and kept support available for follow-up. - Trigger.dev can be self-hosted, which some note mitigates the specific criticism about outsourcing core infra. **The pushback** - Marking the incident 'resolved' so quickly, without a detailed postmortem or root-cause disclosure, is seen as premature and bad optics for a breach involving customer secrets. - Many feel the company can't actually fix the damage since rotating leaked third-party API keys is the customers' burden, not something the vendor can resolve for them. - Several argue outsourcing core functionality like job queues, auth, and env var storage to third-party SaaS is an unnecessary and risky anti-pattern. - Skepticism that security is taken seriously across the industry generally, with some saying these incidents are becoming routine. - No disclosure yet of the actual vulnerability/exploit mechanism, leaving open whether it's related to a known CVE seen in a similar competitor breach. **By community** - hackernews (heated): Heavy disagreement over whether marking the incident 'resolved' so quickly was appropriate, alongside tangents about outsourcing infra, self-hosting, and broader industry security culture. **Hottest debate:** Whether it was acceptable for the company to mark the status-page incident as 'resolved' versus keeping it 'mitigated' pending a full postmortem and customer remediation. **Open questions** - What was the actual vulnerability or exploit technique used to gain access? - Is this related to the same CVE referenced in a similar competitor's breach? - What concrete steps, if any, has the company taken beyond emailing affected customers? **Highlights** > What makes you think it's fixed? They just state that they "blocked the exploit", and that could mean anything: - did they just take the affected API offline? - or did they just disable the account of the attacker? - or is the exploit actually being fixed? Environment variables are sensible data, and marking a security incident as resolved with that little detail is quite a take. Even changelog entries for harmless bug fixes are more detailed. > — [whilenot-dev on hackernews · 1 comments](https://news.ycombinator.com/item?id=50333853) > It's not that they can't mark it as resolved. It's just that it is bad business to do so. How they handle the communication on the incident is crucially as important as remediating the original cause. Just the fact that they are doing this means I will probably never use this service or recommend this service to anyone else. > — [jtchang on hackernews · 1 comments](https://news.ycombinator.com/item?id=50333468) > I am sorry, this is "Resolved"? How can they even consider marking this resolved in any situation. Yeah we exposed your env vars but we told you about it over email so it's all good... We dont know how or to what extend though. > — [corvad on hackernews · 1 comments](https://news.ycombinator.com/item?id=50333116) > Northflank mentioned they patched CVE-2026-98432. This appears to be similar, though not confirmed by trigger.dev yet > — [bbartlomiej on hackernews](https://news.ycombinator.com/item?id=50335525) > This also happened to a trigger.dev competitor a few months ago, inngest. I was able to patch before it was exploited but that definitely made me question the service. > — [BADCAFE on hackernews](https://news.ycombinator.com/item?id=50333870) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50331784) · 140 points · 73 comments ## Similar posts on daily.dev - [Security briefing: May 2026](https://daily.dev/posts/security-briefing-may-2026-bwmlv6zor) · Sysdig Blog · 0 upvotes · 0 comments - [Preliminary Report: Oct 21st Security Incident](https://daily.dev/posts/preliminary-report-oct-21st-security-incident-9lrevx8xo) · Railway Blog · 0 upvotes · 0 comments - [Trivy Scanner Compromise Explained and What it Means For Your SaaS and CI/CD Security](https://daily.dev/posts/trivy-scanner-compromise-explained-and-what-it-means-for-your-saas-and-ci-cd-security-mphhq7ti6) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Trigger.dev customer environment variables exposed","url":"https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89"},"datePublished":"2026-11-02T13:01:59.844Z","dateModified":"2026-11-02T16:52:44.163Z","description":"An attacker gained unauthorized access to environment variables for a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8e42d978e67003e65e0cb1acf8139ed?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8e42d978e67003e65e0cb1acf8139ed?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-breach","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"Trigger.dev customer environment variables exposed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/trigger-dev-customer-environment-variables-exposed-agq3fdt89#faq","mainEntity":[{"@type":"Question","name":"What happened in the Trigger.dev security incident in November 2026?","acceptedAnswer":{"@type":"Answer","text":"An attacker gained unauthorized access to environment variables belonging to a subset of Trigger.dev organizations. Trigger.dev says it has blocked the exploit used to carry out the attack and emailed all impacted account owners with steps to mitigate the exposure. Further updates are being posted to Trigger.dev's status page. Teams relying on Trigger.dev for secrets can track incident response news like this on daily.dev."}}]} ```