trigger.dev

Trigger.dev Security Hardening Guide

Least-privilege permissions

• Grant API keys and external service credentials with minimal scopes required for each workflow; use dedicated, role-limited tokens for each integration rather than reusing broad credentials.
• Implement credential rotation policies (30–90 day cycles) and retire keys immediately upon team changes or suspected compromise.
• Use Trigger.dev's secret management features (never hardcode secrets); enforce encryption of secrets at rest and restrict read access to authorized personnel only.
• Audit and disable unused integrations and third-party connections in your Trigger.dev workspace to reduce attack surface.

Network isolation

• Deploy Trigger.dev workflows in a private environment or VPC if available; restrict outbound egress to only required external service endpoints via firewall rules.
• Use allowlists for approved external APIs and block all unapproved destinations to prevent workflows from exfiltrating data to attacker-controlled endpoints.
• Enable TLS 1.2+ for all data in transit, including state checkpoints and inter-service communication within your workflow orchestration.
• Separate development, staging, and production Trigger.dev instances with distinct credentials and network policies to limit blast radius.

Monitoring

• Log all workflow executions, credential access, and integration calls to a centralized SIEM; alert on failed authentication, permission denials, or unexpected external calls.
• Monitor dependency updates and CVEs for Trigger.dev and its npm dependencies (GitHub advisories, Snyk, or similar tools); establish a patching cadence given limited recent download signals.
• Set up alerts for state persistence anomalies (unusual data sizes, retention duration changes) and failed encryption validation checks.
• Track and audit who creates, modifies, or deploys workflows; correlate with unexpected data access or exfiltration patterns.

Red flags to watch for

• Workflows accepting user-supplied prompts or dynamic task definitions without input sanitization or schema validation—treat as injection vectors.
• Unvetted or dormant dependencies; if Trigger.dev or its libraries lack recent commits, security patches, or maintenance signals, escalate to the security team before production use.
• Workflows persisting sensitive state (API keys, PII) without explicit encryption or retention policy verification—confirm data is not logged unnecessarily or retained beyond workflow lifetime.
• Overly permissive integrations (e.g., a workflow granted read/write access to all your cloud storage or customer database) or missing audit trails for third-party API calls.