If you deploy anything on Railway, revoke and rotate your private keys now. The company said all of its customers should do so after hackers were able to decrypt some customer secrets.
"Secrets" are the credentials a project needs to run: API keys, database passwords, access tokens. Railway, which describes itself as a vibe-coding platform (one where much of the code is generated by AI prompts), stores them for customers in encrypted form. The attackers got past that protection for some of them. "Rotating" means generating a new key and cancelling the old one, so a stolen copy stops working.
The company's wording is the notable part. It asked all users to act, not only those whose secrets were decrypted. That suggests a precaution rather than a precise list of victims, though that is our reading, not something the company has laid out. Also unclear is how many customers were affected and how the attackers got in.
The practical burden falls on customers. Railway cannot rotate a key issued by a cloud provider, payment processor or database host. Each user has to log in to every connected service, issue a replacement and update their deployments.
Blanket rotation requests are a familiar, if unwelcome, pattern. CircleCI, a continuous-integration service, asked its customers to rotate every secret after a breach in January 2023. In both cases the platform holds the keys to its customers' other systems, which is why one incident can spread. The open question for Railway is whether it will explain how the decryption happened, since that determines how far customers can trust the fix.