Attacker could view secret settings of some customers of developer platform Trigger.dev
The TypeScript platform for AI agents and background jobs says the hole has been closed but is silent on the cause and the number of customers affected.
Trigger.dev, an open source platform on which developers build and run background jobs and AI agents in TypeScript, reported a security incident on Sunday. According to the statement on its own blog, an attacker gained unauthorised access to the environment variables of a subset of the organisations using the platform. The company says the weakness that was used has been blocked and the owners of affected accounts received an email with steps to limit the damage.
Trigger.dev does not say how the attacker got in or how many customers were affected. It also declined to give The Register details pending a full incident report. RuntimeWire, which quotes chief technology officer Eric Allam, points out that such variables often contain API keys and passwords that can open access to other services and infrastructure.
The Register notes that customers who want to avoid the risk of a hosted service can also run the platform themselves, since the code is open. Anyone who stored secrets in Trigger.dev would do well to replace them, according to the trade press.