Railway warns devs to rotate secrets after potential breach

Cloud hosting provider Railway published an urgent warning to users after detecting suspicious activity on its systems that store customer environment variables earlier this week.

The company says its investigation indicates that, in some cases, an unauthorized third party may have obtained decrypted variables and urges all users to proactively rotate secrets and credentials.

“Our investigation to date indicates that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents,” Railway says.

“Environment variables may contain secrets such as API keys or database and registry credentials,” the company clarifies.

Railway is a cloud platform for developers to deploy and run applications, APIs, databases, and various backend services. It has around 4.8 million users and hosts more than 16 million services.