Railway pauses deployments after possible secret exposure

Railway says anomalous activity involved systems that store customer environment variables. Its initial analysis indicates an unauthorized third party may have accessed encrypted variables and obtained the decrypted contents of some. Railway says the impact may be limited to a subset of users, but has not published a count. Environment variables may contain API keys, database credentials, and private registry access. The notice describes possible access, not confirmed exposure of every customer or every secret. (Railway security disclosure)

Railway recommends that all users rotate environment variables, including API keys and private registry credentials, and review relevant service logs for unusual activity. It paused all deployments while it investigates. (Railway security disclosure)

Recovery work is constrained by the build pause

At 00:22 UTC on October 22, Railway said users may see storage-bucket credential revocations in their audit logs or activity panels and described those events as expected while it rotates credentials. At 01:22 UTC, Railway said it had published customer guides for checking provider usage, rotating database credentials, redeploying storage buckets, reconnecting GitHub, and reviewing cloud and AI-provider access. The page also said builds remained unavailable and some recommended steps require redeployment that customers cannot complete until builds return. (Railway incident status)

Railway says it is rotating all storage bucket credentials and that replacement values appear in customer dashboards automatically. Its status page warns that paused builds prevent customers from redeploying to pick up those values. This creates a temporary gap between credential rotation in the control plane and use of the replacement credentials by deployed services. Customers should follow Railway's provider-specific guides, review usage and access logs, and check the status page before attempting changes that require a new build. (Railway incident status)

The available updates do not identify a confirmed affected-customer count or establish that every environment variable was decrypted. Railway says it will contact customers it confirms were affected and will post further scope information as its review continues. (Railway security disclosure)