Your API keys stored on Railway may have been read: rotate them all

On October 21 at 7:24 a.m. (UTC), Railway's status page reported a simple issue under investigation. Two hours later, the dashboard, the API and the command-line tool were down, and builds were suspended in all regions. It took until the evening to understand why: at 9:59 p.m., the company published a security notice.

Railway, a US platform that hosts and deploys web applications, explains that it detected abnormal activity on the systems that store its customers' environment variables. These variables often hold an application's secrets: API keys, database passwords, private registry credentials. According to the company, an unauthorized third party may have accessed these encrypted variables and, for some of them, obtained the decrypted contents.

Who is affected?

Railway is cautious. Its initial analysis suggests that only some users are affected; it will contact affected customers directly by email. It has not given a number of accounts, an entry point or the identity of the attacker. But its recommendation applies to everyone: change all the variables stored with it, including private registry credentials, and review the logs of the services concerned.

One detail stands out. Railway believes the incident is part of a recent series of attacks on technical platforms, carried out to compromise AI providers. It says it warned its providers in advance so they could revoke keys as a precaution, without naming them. Its guides published on October 22 cover OpenAI, Anthropic, Grok and OpenRouter keys in particular, as well as Stripe, GitHub, AWS and Google Cloud. It is the same target as in the key leak at OpenCode: a stolen AI key can be resold or used directly at its owner's expense.

What to do if you use Railway

Railway has taken several measures itself: all its API tokens have been invalidated, storage credentials have been renewed and login sessions have been canceled. Deployments are resuming in stages, starting with the Enterprise and Pro plans. On your side:

• revoke, then replace every key stored in Railway, at the provider itself: creating a new key does not cancel the old one;
• change the passwords of your PostgreSQL, MySQL, Redis or MongoDB databases, then redeploy the services that use them;
• check usage and billing on your AI and payment accounts over the recent period;
• look for unusual access in your GitHub, AWS and Google Cloud accounts;
• create new Railway API tokens for your automation tools.

The main question remains: how could encrypted values be read in plain text? Railway's notice does not say, and nothing indicates at this stage that the encryption itself was broken.