Railway Security Disclosure

Railway, a cloud platform where developers deploy apps and keep their configuration and secrets as environment variables, said on October 21 that it had detected anomalous activity involving the systems that store those variables. In the company's words, its investigation so far "indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Those variables can hold API keys and database or registry credentials. Railway says its initial analysis suggests the impact may be limited to a subset of users, but it recommends that every user immediately rotate all environment variables stored in Railway, including API keys and private registry credentials, and review service logs for unusual activity. It says it will email affected customers as it confirms who they are.

Railway adds that it believes the incident is part of a series of attacks on platform companies "with the aim of compromising AI inference providers," and that it has notified those upstream providers to revoke all keys proactively. The post does not name the providers or the other platforms, and it does not say how the attacker got in, how the decrypted values were obtained, or how many accounts were affected. The follow-up guides listed on Railway's status page point in the same direction: alongside AWS, Google Cloud, GitHub, Stripe and database credentials, they include checking for unexpected OpenAI, Anthropic, Grok and OpenRouter usage.

The practical difficulty is that a new secret only takes effect once a service is redeployed, and Railway paused all deployments while it investigated. Its AWS guide and Google Cloud guide both treat updating a key on Railway as a variable edit followed by a redeploy, and the Google Cloud guide warns that once you disable the exposed key, your Railway services cannot authenticate until the new key is deployed. Steps that need no redeploy, such as reviewing CloudTrail or Cloud Audit Logs and billing for activity you didn't generate, can start immediately. Railway's status page said on October 21 that it was also rotating all storage bucket credentials itself, and its 03:32 UTC update on October 22 said builds were back for Enterprise workspaces, with Pro, Hobby, then Free and Trial plans to follow in stages.