Railway Freezes All Updates After Detecting Possible Leak of Client Secrets

Railway detected unusual activity in its environment variable storage early Wednesday and immediately halted every deployment, including for Enterprise customers.

A security report issued on 21 October states an attacker may have reached encrypted secrets and, in some cases, obtained their decrypted values. Although the breach appears limited so far, the company is telling every user to rotate API keys, database credentials and other secrets as a precaution.

New releases remain blocked while the platform restores service in stages, starting with Enterprise workspaces. Railway has also ended active sessions for some accounts and is rotating its own storage credentials.

The company, which counted two million developers and tens of thousands of businesses in January, will send direct emails to affected users and urges everyone to review logs for suspicious activity.

Based on information from cryptonews.net