Security incident report: Sunday November 1st

On November 1, 2026, Trigger.dev detected and contained a malicious security incident affecting approximately 0.66% of customers, during which an attacker obtained customer root API keys for certain environments and could access their settings, including environment variables. The attacker also accessed limited operational information in some affected environments, such as run, deployment, and schedule metadata, but Trigger.dev reported no evidence of access to other customer data, production databases, dashboard accounts, or services. The company revoked potentially exposed API keys, notified impacted customers by email and dashboard alerts, advised them to regenerate Trigger.dev keys and rotate affected database passwords, third-party API keys, and access tokens, and engaged cybersecurity experts and law enforcement. Trigger.dev also rotated internal secrets, reviewed logs, introduced IP whitelisting for scoped API keys and OIDC support, and plans further security improvements; self-hosted deployments and webhook signing secrets were not affected.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.