Railway Freezes Deployments, Orders Users to Rotate Keys

Railway halted deployments and told every customer to replace API keys after warning that an unauthorized party may have made some stored customer secrets readable, creating a potential exposure risk for crypto teams using the platform.

Suspicious activity was detected on Oct. 21 in Railway systems that store customer environment variables. Those settings can hold API keys, database credentials and private registry credentials. The company’s initial review indicated that only a limited subset of users may be affected.

Railway advised customers to replace stored variables and review service logs for unusual activity. Railway planned to email users as it identified affected accounts. The party’s identity and the number of affected accounts were not disclosed.

At 12:14 p.m. ET (16:14 UTC) Oct. 22, Pro and Enterprise deployments were running at normal speed, although some builds failed shortly after starting. Railway was still restoring builds for Hobby, Free and Trial plans.

The exposure matters to crypto teams because API keys and other credentials may be stored in those environment variables.