Railway Urges Its Users to Replace Potentially Exposed Google Cloud Keys

Railway urged customers using Google Cloud (GCP) service-account keys on its deployment platform to disable keys that may have been exposed, replace the credentials and redeploy services. Its guidance also calls for reviewing cloud audit logs and billing for unauthorized resource creation, permission changes and unusual charges.

The steps follow Railway’s Oct. 21 security incident disclosure and extend its earlier credential-rotation guidance.

Service-account keys do not expire by default and can remain usable until disabled. Short-lived tokens issued before a key is shut off may remain valid for up to one hour. Railway advised disabling the entire service account to cut off access immediately.