From d9cb4778f93ea45b2b4bab442a01c23e2a683379 Mon Sep 17 00:00:00 2001 From: Chris Arderne Date: Wed, 22 Jul 2026 13:18:16 +0100 Subject: [PATCH 1/3] fix(cli): redact task run env values from debug log The "initializing task run process" debug log serialized the full worker environment (fullEnv), including TRIGGER_SECRET_KEY, TRIGGER_JWT, and any customer secret env vars. Log only the env var names instead of the values. --- .changeset/redact-taskrunprocess-env-log.md | 5 +++++ packages/cli-v3/src/executions/taskRunProcess.ts | 4 +++- 2 files changed, 8 insertions(+), 1 deletion(-) create mode 100644 .changeset/redact-taskrunprocess-env-log.md diff --git a/.changeset/redact-taskrunprocess-env-log.md b/.changeset/redact-taskrunprocess-env-log.md new file mode 100644 index 00000000000..2c1b3678622 --- /dev/null +++ b/.changeset/redact-taskrunprocess-env-log.md @@ -0,0 +1,5 @@ +--- +"trigger.dev": patch +--- + +Stop logging task run environment variable values at debug level. The `initializing task run process` debug log previously serialized the full worker environment, which includes `TRIGGER_SECRET_KEY`, `TRIGGER_JWT`, and any secret env vars set for the run. It now logs only the env var names, so secrets no longer appear in run logs when debug logging is enabled. diff --git a/packages/cli-v3/src/executions/taskRunProcess.ts b/packages/cli-v3/src/executions/taskRunProcess.ts index 66b30269ada..cb2476df338 100644 --- a/packages/cli-v3/src/executions/taskRunProcess.ts +++ b/packages/cli-v3/src/executions/taskRunProcess.ts @@ -150,8 +150,10 @@ export class TaskRunProcess { TRIGGERDOTDEV: "1", }; + // Only log env var names, never values: fullEnv contains secrets + // (TRIGGER_SECRET_KEY, TRIGGER_JWT, and arbitrary customer secret env vars). logger.debug(`initializing task run process`, { - env: fullEnv, + envKeys: Object.keys(fullEnv), path: workerManifest.workerEntryPoint, cwd, }); From b8bdef31228b01c1b37fa823b31720565211046f Mon Sep 17 00:00:00 2001 From: Chris Arderne Date: Wed, 22 Jul 2026 13:23:15 +0100 Subject: [PATCH 2/3] chore: shorten changeset --- .changeset/redact-taskrunprocess-env-log.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/redact-taskrunprocess-env-log.md b/.changeset/redact-taskrunprocess-env-log.md index 2c1b3678622..5c94fdec4d9 100644 --- a/.changeset/redact-taskrunprocess-env-log.md +++ b/.changeset/redact-taskrunprocess-env-log.md @@ -2,4 +2,4 @@ "trigger.dev": patch --- -Stop logging task run environment variable values at debug level. The `initializing task run process` debug log previously serialized the full worker environment, which includes `TRIGGER_SECRET_KEY`, `TRIGGER_JWT`, and any secret env vars set for the run. It now logs only the env var names, so secrets no longer appear in run logs when debug logging is enabled. +Avoid logging task run environment variable values at debug level From 02d36175dfbd719748452d01b83b01b08d32e053 Mon Sep 17 00:00:00 2001 From: Chris Arderne Date: Wed, 22 Jul 2026 13:23:38 +0100 Subject: [PATCH 3/3] chore: remove comment --- packages/cli-v3/src/executions/taskRunProcess.ts | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/cli-v3/src/executions/taskRunProcess.ts b/packages/cli-v3/src/executions/taskRunProcess.ts index cb2476df338..03504c412e4 100644 --- a/packages/cli-v3/src/executions/taskRunProcess.ts +++ b/packages/cli-v3/src/executions/taskRunProcess.ts @@ -150,8 +150,6 @@ export class TaskRunProcess { TRIGGERDOTDEV: "1", }; - // Only log env var names, never values: fullEnv contains secrets - // (TRIGGER_SECRET_KEY, TRIGGER_JWT, and arbitrary customer secret env vars). logger.debug(`initializing task run process`, { envKeys: Object.keys(fullEnv), path: workerManifest.workerEntryPoint,