Trigger.dev Breach Exposes Customer Environment Variables: Why Stolen Credentials Could Reach Further Than You Think

Trigger.dev, a cloud-hosted platform for building AI agents and workflows in TypeScript, disclosed a security incident on Sunday. The company said its investigation found exposure across a subset of organisations, and that an attacker gained unauthorised access to environment variables belonging to them. It has blocked the exploit used and notified affected customers of the steps they need to take. The company has offered little detail beyond that.

Environment variables matter because they often hold sensitive credentials such as API keys. If those are stolen, an attacker could potentially reach connected services and digital infrastructure, depending on what the credentials allow. Trigger describes its platform as built for long-running tasks, with automated retries, queues and elastic scaling, which means a compromised key could be used at scale. The report also notes that Trigger recently added webhook support for services including Stripe, Supabase and Slack, which could widen the range of integrations affected if credentials were exposed.

An attacker holding stolen credentials could potentially interfere with a customer's connected services or workflows. Businesses using Trigger.dev should check whether they have been notified and follow the guidance they received. Even if you have not been contacted, it is worth knowing which credentials are stored on the platform and what each one can access.