Railway security disclosure, 21 October 2026
Rotate every key, in the right order.
Railway reported that environment variables may have been accessed, and some decrypted. Their advice: roll every variable, including registry credentials. Paste yours below to get a checklist ordered by risk, with a direct link to rotate each key.
Source: Railway's security disclosure. If your OpenAI or Anthropic calls suddenly fail with 401 errors, the provider may have already revoked the key.
Your .env file, or Railway's Variables tab → Raw Editor. One service at a time works too.
Runs in your browser. Values are never uploaded or saved.
For every key
- 1Rotate each key at the provider (links below).
- 2Put the new value everywhere it is used: your host, CI secrets, local .env files.
- 3Redeploy, then revoke the old key.
- 4Check each provider's usage or logs for activity you don't recognise.
Where else do these keys live?
Rotating is only half the job if the same key is also sitting in a repo or its git history. Scan your GitHub repos for free in under a minute.
Scan my repos freeNever do this by hand again
Leakmoat Pro will rotate a key across every service that uses it, in one pass. Get early access.
Leakmoat is independent and not affiliated with Railway. The checklist runs entirely in your browser; only variable names are kept, in this browser, so you can come back to it.