Railway reported potential access to secrets: what to do with AI API keys

What Railway confirmed

In a message from October 21, the company reported unusual activity in the systems storing client environment variables. According to preliminary investigation results, an unauthorized party may have gained access to encrypted variables and the decrypted content of some of them. Such variables may contain API keys, database credentials, and private registry credentials.

As a precaution, Railway recommended all users to rotate these secrets and review the logs of the relevant services. Source — official incident disclosure. It describes the investigation that was ongoing at the time; we do not claim that every client was affected.

If your project is running there

Start with a list of secrets in Railway, rather than a random reinstallation of the entire project. For each one, record the provider, purpose, and the services that use it. Do not copy the actual key values into this table.

Then, open the key provider's dashboard: check for unusual spending, timing, and request types. Save necessary records for analysis. Create a replacement with the minimum required permissions, update the dependent services, verify their operation, and revoke the old secret. If you already see active abuse, the priority is to immediately terminate access, even if the application temporarily stops. This is an editorial procedure; specific buttons depend on the provider.

Why a restart is not the same as replacing a key

A hypothetical example: a bot continues to use the same key after redeployment. If a copy of the key is already held by someone else, the new version of the bot does not cancel it. Revocation is required on the side of the service that issued the key, not just by changing a configuration file.

Similarly, a spending limit reduces the potential bill but does not replace access control. Using separate keys for test and production environments helps identify exactly which system needs to be checked.

If you do not use Railway

This announcement is not proof of a compromise of your hosting or our website. A useful action here is to check your own readiness: do you have a list of secrets, do you know how to revoke them, and are you not using a single key across ten old demos at the same time?

This is especially often forgotten in vibe-coded prototypes: the demo is ready, but test access remains forever. Ask an assistant to compile a list of secret usage locations by variable names. Do not paste the actual key values into a public chat or screenshot.

What to check in updates

Check the current service status on the Railway status page; this is better than republishing an old message about deployment pauses as 'breaking news.' In your own project, the result should be a list of replaced and revoked secrets and a verification of dependent functions.

Next: how to store API keys in your own AI project. The presence of an instruction does not mean your project's keys are already verified.

Sources and method

• Railway — Security Disclosure, 21.10.2026
• Railway — current service status

Facts about the services have been verified against official materials. Examples, prompts, and the workflow were prepared by the editorial team. This is not a comparative test of model accuracy or speed. How we work.