Railway Security Disclosure

Railway has disclosed a security incident involving unauthorized access to encrypted environment variables. It appears that a third party may have obtained decrypted contents from some of these variables, which could include API keys or other sensitive credentials. This breach is believed to be part of a series of attacks targeting platform companies with the goal of compromising AI inference providers.

In response to the incident, Railway has notified upstream providers to revoke all keys proactively. While the impact may be limited to a subset of users, Railway is recommending that all users roll back all environment variables, including API keys and private registry credentials, as a precautionary measure. All deployments are currently paused while the investigation is ongoing.

For those unable to roll out new versions, Railway apologizes for the inconvenience. As the investigation progresses, those affected will be notified directly by email and further updates will be posted on status.railway.com.