Trigger.dev (API Hero Ltd) published a security incident report dated 6 November 2026, following an original 1 November disclosure, saying that on 1 November 2026 it became aware of a security incident that impacted some customers, including unauthorised access to environment variables, and that this impacted 0.66% of all customers.

Trigger.dev says it contained and remediated the incident, notified all impacted customers, engaged cybersecurity incident response experts, and notified law enforcement.

It says that on 1 November it received infrastructure alerts for anomalous activity, identified the activity as malicious, blocked the attacker and mitigated the attack vector; it says it cannot yet comment on the specific attack vector to protect the investigation and customers.

Trigger.dev says the attacker obtained Trigger.dev customer root API keys for some customer environments, and that a customer root API key gives full access to that environment's settings, including its environment variables.

In some customer environments, it says the attacker listed recent runs, deployments and schedules, returning data including run IDs, deployment IDs, schedule IDs, task names, run idempotency keys, run status, run tags, deployment metadata, deployment error, schedule external id, and run metadata.

Trigger.dev says it found no evidence that the attacker accessed any other customer data, any services, any of its production databases, or any customer dashboard accounts.

It says it contacted all affected customers by email and through the dashboard with details of the environments involved and guidance on rotating credentials, and that it proactively revoked any potentially impacted Trigger.dev API keys for all impacted environments.

Impacted customers, it says, received emails on 1 November at approximately 21:36 UTC and again on 2 November at 20:27 UTC and see a notification banner in the dashboard; organisations that did not receive an impact notification were not affected. Recommended actions for impacted customers: regenerate Trigger.dev API keys (exposed keys revoked) and rotate credentials in affected environments including database passwords, third-party API keys and access tokens.

Trigger.dev says self-hosted deployments were not impacted; webhook signing secrets were not exposed; stored environment variables are encrypted at rest and decrypted just-in-time for run execution.

Actions it reports taking include removing attacker access, rotating its own internal credentials, reviewing API access logs across customer environments, risk-based automated account restrictions, releasing IP whitelisting for scoped API keys, and releasing OIDC support. (source: Trigger.dev)