Security Disclosure

Railway detected unusual activity involving its systems that store customer environment variables. After further investigation, it appears an unauthorized third party may have gained access to encrypted environment variables and, for some, decrypted the contents. Environment variables can contain sensitive information like API keys, database credentials, and registry access.

Railway suspects this is part of a recent wave of attacks targeting platform companies to compromise AI inference providers. They have proactively notified upstream providers to revoke all keys and have issued a precautionary recommendation for all users to take security measures. Railway advises users to immediately roll all environment variables stored in Railway and review logs for any unusual activity.

All deployments have been paused during the investigation, and users will not be able to roll out new versions until they are restored. Railway apologizes for the inconvenience and will notify affected customers directly once they confirm the scope of the breach. They will also provide updates on the status.railway.com website. Developers are encouraged to check for anomalous access to Google Cloud Platform (GCP) and Amazon Web Services (AWS) accounts.