A platform can encrypt a secret at rest and still face a serious incident if an attacker reaches a path that exposes its decrypted value. Railway's October 21 security notice says an unauthorized third party may have accessed encrypted customer environment variables and obtained the decrypted contents of some of them.[1]

Railway has not said that every customer was affected. Its initial analysis suggests the impact may be limited to a subset, while its precautionary recommendation applies to all users.[1] This is an evolving incident, so check Railway's notice and status page before acting on older summaries.[2]

What Railway has disclosed

Railway says the affected systems store customer environment variables. Those values can include API keys, database access, or credentials for private registries.[1] The company also says it believes the incident is part of a broader series of attacks against platform companies intended to reach AI inference providers.…