Trigger.dev CLI debug logs print environment secrets in plain text

A security advisory published on 2 October 2026 says the Trigger.dev command-line tool prints resolved environment variable values, including database connection strings and service credentials, into its debug output.

The advisory, GHSA-fj2x-mqqp-3v2w, affects the npm package trigger.dev at version 4.5.3. The report notes that version 4.5.6 was advertised by the CLI but was not tested.

According to the advisory, the problem appears during a staging dry run. The reporter ran a deploy command against the staging environment with the dry-run flag and the debug log level set. The debug output logged the complete build-worker options object. One property of that object, envVars, contained unredacted values for every resolved staging variable.

That behaviour contrasts with the rest of the tool. The advisory states that the non-debug environment listing correctly hides values, so users can reasonably expect deployment logs not to print secrets.

The practical risk is that secrets end up in places that are routinely copied, stored and shared. The advisory says anyone with access to a developer terminal transcript, a continuous integration debug log, captured agent or tool output, or a support bundle can recover deployment secrets. That holds even though a dry run does not actually deploy anything. In other words, a command that is meant to be a safe rehearsal still writes live credentials to disk and to logs.

Trigger.dev is a platform for running background jobs and workflows, and the CLI is the tool developers use to build and deploy those workflows. Because dry runs and debug logging are often turned on inside automated pipelines, the exposed values can be duplicated across build systems without anyone looking at them directly. Captured agent and tool output is named in the advisory as one of the affected channels, which matters for teams that pipe CLI output into automated assistants or logging agents.

The reproduction steps given in the advisory are short. A tester configures a Trigger.dev project with a secret environment variable, runs the deploy command with the staging environment, the dry-run flag and debug logging, then inspects the Starting buildWorker debug record. The options.envVars entry contains the plaintext value.

The advisory states that no real credential is included in the report, and that the observed customer credentials are being rotated separately.

The reporter suggests that the fix is to never serialise envVars values in debug output. Instead, the advisory recommends logging names only, or replacing every value with a fixed marker. It also calls for regression tests covering deploy, dry-run and debug logging paths, and a review of adjacent debug records to check whether other resolved secrets are being written out in the same way.

The incident record for this disclosure lists the root cause as a misconfiguration rather than a memory-safety or injection flaw. The status is recorded as reported. No patched version is identified in the advisory text.

Teams running the affected release should assume that any secrets printed by a debug-level deploy are compromised wherever those logs were stored, and treat rotation as the first step rather than the last. The advisory does not state when the behaviour was introduced, and does not list a fixed version.