Trigger.dev CLI debug logs expose resolved environment secrets

Trigger.dev's CLI debug output leaked resolved environment variable values including database credentials and service tokens during dry-run deployments. The vulnerability exposed secrets in terminal transcripts, CI logs, and support bundles.

Disclosed 2 October 2026 · Record updated 2 October 2026

Impact

Environment secrets including database connection strings and service credentials exposed in debug logs accessible via terminal transcripts, CI logs, and support bundles

Our coverage

A factory worker pulls debug papers from a malfunctioning machine, revealing handwritten passwords and keys scattered across the floor in plain sight.

Vulnerabilities

Trigger.dev CLI debug logs print environment secrets in plain text

A GitHub security advisory published on 2 October 2026 says the workflow platform's command-line tool leaked resolved secrets during dry-run deployments.

2 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-fj2x-mqqp-3v2w