Railway freezes builds and tells all users to rotate keys after possible breach

Railway paused all deployments Wednesday after an unapproved party may have accessed customer environment variables and told all users to rotate stored secrets immediately. In an Oct. 21 disclosure, the cloud platform said it detected anomalous activity in systems storing environment variables, which hold app settings and secrets such as API keys and database or registry credentials. Railway said initial analysis indicated a limited subset of users may be affected, but the review is ongoing and everyone should act as if exposed. Builds remained paused at 3 a.m. UTC on Oct. 22; Railway, which announced in January that 2 million builders and tens of thousands of companies use the platform, said it was rotating storage-bucket credentials and invalidating OAuth sessions.