Toolsstrong signal
Railway asks all users to rotate their secrets after attackers read some decrypted environment variables
The app hosting platform says an unauthorized party may have reached the systems that store customer environment variables, and decrypted some of them. Railway believes the impact is limited to a subset of users but wants everyone to replace their keys. Its recovery guides add that sessions, tokens and GitHub connections were revoked, and that commits pushed during the outage were never deployed.
Railwayverified