# Railway Urges Its Users to Replace Potentially Exposed Google Cloud Keys By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/38366 Published: 2026-10-22T21:24:14.000Z Updated: 2026-10-22T21:24:14.000Z Section: Technology > The platform urged customers to disable suspect keys, replace credentials, redeploy services and check cloud logs and billing for unauthorized activity. Railway urged customers using Google Cloud (GCP) service-account keys on its deployment platform to disable keys that may have been exposed, replace the credentials and redeploy services. Its guidance also calls for reviewing cloud audit logs and billing for unauthorized resource creation, permission changes and unusual charges. The steps follow Railway’s Oct. 21 security incident disclosure and extend its earlier [credential-rotation guidance](). Service-account keys do not expire by default and can remain usable until disabled. Short-lived tokens issued before a key is shut off may remain valid for up to one hour. Railway advised disabling the entire service account to cut off access immediately. ## Links in this article - [credential-rotation guidance](https://www.tokenpost.com/news/technology/38129)