What happened in the Railway security incident

On Oct. 21, 2026, Railway disclosed anomalous activity on the systems that store customer environment variables.

An unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted values. Railway is asking all customers to rotate their environment variables, including API keys and private registry credentials, and has paused deployments during the investigation.

Railway believes the impact is limited to a subset of users, who will be contacted by email. It links the attack to "a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," a pattern that echoes the Vercel incident from April.

Investigate, then rotate every Railway environment variable

Treat every secret stored in Railway as at risk until investigated. Identify the exposed credentials, check where they are used, and confirm whether they are still active or already abused. Then revoke or rotate them, redeploy, and verify dependent services.

Railway sealed variables cannot be read back from the UI, the API, or the CLI. That limits casual exposure, but the disclosure does not say whether they were in scope. Rotate them too.

How to scan Railway environment variables for secrets

Railway customers can dump their environment variables locally and scan them.

Dump the variables of each service and environment:

railway variable list --service <service> --environment <environment> --kv > .env.railway

Then scan the file with GitGuardian:

ggshield secret scan path .env.railway

GitGuardian identifies which variables contain valid secrets. This gives you a prioritized list of what to rotate first. If you dumped several services into the same directory, scan them all at once:

ggshield secret scan path -r .

Rotate secrets in upstream services, such as AWS, GCP, GitHub, or AI providers, before updating the values in Railway. Delete the dumped files once done.

Railway recommends that customers:

  • Rotate all environment variables stored in Railway, including API keys.
  • Rotate private registry credentials.
  • Review logs of the services using these credentials for unusual activity. Railway published dedicated guides for AWS, GCP, and GitHub.
  • Follow the status page, since new deployments are paused until builds are restored.

Talk to GitGuardian to see how you can strengthen your security controls.

Book the demo now.