# Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

Default secrets in trigger.dev's Docker .env.example let attackers forge magic links, auto-create accounts, and reach unauthenticated Postgres/Redis/ClickHouse on runner networks.

- Payout: Research
- Severity: high
- Program: Trigger.dev
- Found by: sfwani
- Disclosed: 2026-10-02
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pqxw-g93w-hj9x
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-pqxw-g93w-hj9x
- Tags: area:web3 domain:infra domain:web3 impact:ato impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:docker technique:source-review vuln:auth-bypass vuln:misconfiguration

**Target:** Self-hosted Docker Compose deployment (webapp, worker, Postgres, Redis, ClickHouse)
**Root cause:** hosting/docker/.env.example ships hardcoded SESSION_SECRET, MAGIC_LINK_SECRET, ENCRYPTION_KEY and MANAGED_WORKER_SECRET; MAGIC_LINK_SECRET signs magic-link tokens with no session-side validation, and runner containers sit on infrastructure networks with default/no-auth DB credentials.
**Steps:**
1. Deploy with `cp .env.example .env` and `docker compose up -d` for webapp and worker.
2. Forge token: `CryptoJS.AES.encrypt(JSON.stringify({e:'attacker@evil.com',c:Date.now()}), '44da78b7bbb0dfe709cf38931d25dcdd')`.
3. Request `https://target:8030/magic?token=<token>`; receive 302 with `__session` cookie and auto-created user.
4. From runner network: `psql "postgresql://postgres:unsafe-postgres-pw@postgres:5432/main"` reads User table.
5. `redis-cli -h redis PING` returns PONG (no auth).
6. `curl "http://default:password@clickhouse:8123/?query=SELECT%20version()"` returns version.
**How found:** Reporter read the shipped .env.example, recognized MAGIC_LINK_SECRET as the remix-auth-email-link AES key with validateSessionMagicLink defaulting false, then checked runner network placement and default DB credentials.
**Exploitation:** Attacker knows the published default MAGIC_LINK_SECRET, forges an AES-encrypted magic-link token for any email, hits /magic to get an authenticated session (account auto-created when WHITELISTED_EMAILS unset), then pivots from the runner network to unauthenticated Postgres, Redis and ClickHouse to read all tenant data and decrypt secrets with the known ENCRYPTION_KEY.
**Escalation:** Session cookie plus SESSION_SECRET reuse for JWT signing and impersonation tokens enables cross-tenant access; DB/registry access allows pushing backdoored images and manipulating job queues.
**Insight:** When auditing self-hosted deployments, treat the shipped .env.example as production config: any secret there that feeds a token-signing library (here remix-auth-email-link's AES magic link) is a forgery key, and check whether the library's validation option is left at its insecure default.