Railway Security Disclosure

Railway disclosed a security incident where unauthorized third parties gained access to encrypted customer environment variables and decrypted some of them, potentially compromising API keys and database credentials. The company has paused all deployments while investigating, recommends all users immediately rotate their environment variables and credentials, and is proactively notifying upstream providers to revoke exposed keys. The impact appears limited to a subset of users, and Railway will provide updates as it determines which accounts were affected.