Trigger.dev exposes customer environment variables in security incident
A workflow automation platform disclosed unauthorized access to sensitive configuration data stored by its users.
What to know
- Trigger.dev, a workflow automation platform, experienced a security incident exposing customer environment variables.
- The company disclosed the incident via a blog post on November 2, 2026.
- Environment variables typically contain sensitive credentials and configuration data critical to application security.
Trigger.dev Affected platform
How it unfolded 1 development · click the chart to see its coverage articlesposts
-
1
Trigger.dev discloses environment variable exposure
Trigger.dev published a security incident report detailing the exposure of customer environment variables. The disclosure appeared on the company's blog and was shared to Hacker News.
-
first by HN Frontpage, 10d ago
-
The very fact that Nextjs vibe projects need an external (and paid!) background jobs / async service show how much of an anti pattern that this framework and similar are. Just use a sensible stack from day one that can handle concurrency out of the box like Elixir or something with established open source background jobs library. Then you can…
2 more of the top 3 · 16 posts in this stretch
-
damn, i've been thinking about the same recently. saas is dead, at least developer oriented saas for sure. the only things i rely on are my own self hosted git (not public to the web), and that's it. all other "developer oriented saas" has been replaced with a home made version with claude. probably not safe from hacking, but id rather take the…
-
As I mentioned in the Northflank breach post:Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprisesAlso, a trick i've started doing is encrypting my…
-
What people are saying 13 voices from 1 site · best of 16 · verbatim
- Nov 2
-
Is your implication that hyperscalers (big companies) will always do better at this than smaller companies?Just becuase a company has more money doesn’t mean they direct that money well, and even money directed well at the wrong people will result in failures.
-
> Also, a trick i've started doing is encrypting my env vars, then hard-code the decryption key in the codeHm. The idea being if creds are leaked independent of the codebase, they’re safe, and if the codebase is cloned/leaked independent of the credential store the decryption key doesn’t hurt anything?
-
Yes, I’d say any infra provider that can't afford to have their own hardware security module should probably not be storing sensitive customer data.
-
As far as my personal life is concerned, I honestly don't think I'm going to 'build and deploy' anything to any SaaS that isn't directly in my control for a while.
-
This should not be marked as "resolved". "Mitigated" until some percentage of customers ack the email notification at least (track clicks, get teams on Zoom call, etc.).
-
What would you consider appropriate action for their incident team to be able to mark the incident on their status page as resolved?
-
This also happened to a trigger.dev competitor a few months ago, inngest.I was able to patch before it was exploited but that definitely made me question the service.
-
Given the recent Claude Code remote access tool, it would be wise to not install any new software, or use any package manager for a few weeks as they could have already been silently backdoored during the aftermath of that incident.
-
The biggest case for building bespoke software is that you drop your attack surface area and it’s not as lucrative to hack one person. Don’t even expose it to the internet if you don’t need to and just run Tailscale.
-
So at this rate, how long before people start hiding use of AI in development of in their SaaS and services? or people really don't care, do they?
- Nov 1
-
Holy smokes, is security just not a priority at all anymore? Like in what world do we live in, that this is acceptable. And at the volume this has been happening, bad guys are having a FIELD DAY.
-
I am sorry, this is "Resolved"? How can they even consider marking this resolved in any situation. Yeah we exposed your env vars but we told you about it over email so it's all good... We dont know how or to what extend though.
-
Have any of these companies disclosed the actual vulnerabilities used to gain access to their systems?