Trigger.dev customer environment variables exposed

Re:Trigger.dev customer environment variables exposed by weird-eye-issue on Monday November 02, 2026 @12:07AM (#50333344)

So the active incident is now fixed and they've already reached out to impacted customers but they can't mark it as resolved yet because they are still yet to publish a more detailed blog post?

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by jtchang on Monday November 02, 2026 @12:35AM (#50333468)

It's not that they can't mark it as resolved. It's just that it is bad business to do so.

How they handle the communication on the incident is crucially as important as remediating the original cause.

Just the fact that they are doing this means I will probably never use this service or recommend this service to anyone else.

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by weird-eye-issue on Monday November 02, 2026 @12:46AM (#50333515)

Okay so let's just say you are one of those affected users

The founder of the company has already emailed you with details and their support team is around for you to ask any follow-up questions. Also the bug/exploit has been fully fixed

At this point are you saying you would actually be upset and leave because the incident on their status page has been marked as resolved?

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by tuwtuwtuwtuw on Monday November 02, 2026 @12:56AM (#50333556)

Yes.

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by weird-eye-issue on Monday November 02, 2026 @01:09AM (#50333627)

Drama queens

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by sebastialonso on Monday November 02, 2026 @10:32AM (#50338229)

> Ask questions > When showed different opinion, complains like a bitch

HN is very cesspool-ly indeed

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by weird-eye-issue on Monday November 02, 2026 @08:34PM (#50346853)

> complains like a bitch

That's what you are doing, congratulations

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by whilenot-dev on Monday November 02, 2026 @01:53AM (#50333853)

What makes you think it's fixed? They just state that they "blocked the exploit", and that could mean anything:

- did they just take the affected API offline?

- or did they just disable the account of the attacker?

- or is the exploit actually being fixed?

Environment variables are sensible data, and marking a security incident as resolved with that little detail is quite a take. Even changelog entries for harmless bug fixes are more detailed.

[ Parent | on HN ]

Re:Trigger.dev customer environment variables exposed by weird-eye-issue on Monday November 02, 2026 @02:08AM (#50333926)

I assume it's fixed based on it being marked resolved and from what was communicated. Yeah I agree it's a major issue but if it's fixed what they have done so far seems totally fine

[ Parent | on HN ]