Fix Me AI
← All guides

Railway breach: a key-rotation checklist that won't break your app

Updated 23 October 2026 · 7 min read

Short answer: On 21 October 2026 Railway said an attacker may have obtained decrypted environment variables for some customers, and asked all users to rotate every secret stored there. Rotating means creating a new key at the provider (OpenAI, Stripe, Supabase and so on), updating it in Railway, redeploying, and only then deleting the old key. Do the keys that cost money or expose user data first.

What happened

Railway disclosed that "an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." It recommended that all users roll all environment variables, including API keys and private registry credentials, and review logs. Railway also reset storage-bucket credentials and GitHub tokens itself, so you need to redeploy and reconnect GitHub. (TechCrunch coverage)

Step 1: list every secret

Open each Railway service → Variables, in every environment. Write down each variable that is a key, token, password or connection string. Don't paste the values anywhere; you only need the names.

Look through my project and list every environment variable it uses that is a secret (API keys, tokens, passwords, database URLs, webhook secrets). For each, tell me which provider it belongs to and where in the code it is used. Do not print any values.

Step 2: rotate in this order

  1. Money keys: OpenAI, Anthropic and other AI providers, Stripe or Razorpay secret keys, cloud keys (AWS, GCP). A stolen AI key can run up a large bill in hours.
  2. User-data keys: database URLs and passwords, Supabase service_role / sb_secret_ keys, Firebase admin credentials.
  3. Everything else: email (Resend, SendGrid), webhooks' signing secrets, OAuth client secrets, JWT/session secrets (this logs everyone out, which is fine).

Step 3: the safe swap for each key

  1. Create a new key at the provider's dashboard.
  2. Replace the value in Railway Variables (every environment that uses it).
  3. Redeploy, and check the feature still works.
  4. Then delete or revoke the old key at the provider. Doing this last is what keeps your app up.
  5. Check the provider's usage or billing page for activity you don't recognise since 21 October.

Step 4: finish the Railway-specific bits

  • Redeploy every service that uses a Railway storage bucket, so it picks up the new bucket credentials.
  • Reconnect GitHub in Railway, and revoke any GitHub personal access tokens you had stored there.
  • Check your Railway audit log and service logs for unusual activity.

Step 5: make sure no secret is also in your frontend

Rotation doesn't help if the new key ends up in browser code. Keys in variables starting with VITE_, NEXT_PUBLIC_ or REACT_APP_ are shipped to every visitor. See is your OpenAI key exposed? and run a free Vibe Check after redeploying.

Check your app in about 60 seconds

The free Vibe Check reads only public pages and gives you a fix prompt for each issue.

Run free Vibe Check

FAQ

Do I need to rotate keys if Railway didn't email me?

Railway recommended that all users rotate as a precaution while it confirms which accounts were affected. Rotating is cheaper than finding out later.

Will rotating keys break my app?

Not if you create the new key, update Railway, redeploy and test before revoking the old one.

Which key should I rotate first?

Anything that can cost money (AI provider, payment and cloud keys), then anything that exposes user data (database and Supabase service keys).

Related guides