In Trigger.dev versions before 4.5.9, executing a dry-run deployment with debug logging enabled (`trigger.dev deploy --env staging --dry-run --log-level debug`) causes the CLI to log the full build-worker options object, including the `envVars` property containing plaintext secret environment variable values. This behavior leaks sensitive information such as database connection strings and service credentials in debug output, contrary to the expected behavior where environment variable values are hidden. The vulnerability arises from serializing and logging secret values instead of only their names or masked placeholders. No active exploitation is reported, and the issue affects local CLI usage rather than a cloud service.

The vulnerability exposes sensitive environment secrets in debug deployment logs, which can be accessed by anyone with access to developer terminal transcripts, CI debug logs, captured agent/tool outputs, or support bundles. This exposure can lead to unauthorized disclosure of database credentials and service secrets, potentially compromising system confidentiality. However, no integrity or availability impact is indicated, and no known exploits are currently in the wild.

A patch is available that prevents serialization of secret environment variable values in debug output. Users should upgrade to version 4.5.9 or later where this issue is fixed. Until patched, avoid running deployments with debug logging enabled in environments containing sensitive secrets. The vendor recommends logging only environment variable names or replacing secret values with fixed markers in debug logs. Additionally, regression tests should be added to prevent recurrence.