Encrypted secrets can still leak.

On Oct 21 (US time), app hosting platform Railway disclosed that an unauthorized party may have accessed encrypted customer environment variables and obtained some users' decrypted values, including API keys and database credentials. The number of affected customers and the entry point have not been disclosed.

Railway is telling every user to rotate or revoke all stored credentials and check their logs. As of Oct 22 morning (KST), new deploys were still paused while builds were being restored.

Railway believes this is part of a series of attacks on platform companies aimed at AI inference providers. Vercel and OpenCode also had incidents this year that may have exposed customer keys, but a shared attacker has not been confirmed.

Why AI keys? Because whoever holds a stolen key runs AI on someone else's bill. At METR, one stolen inference key was used to consume about US$600,000 in (donated) credits over three weeks.

If you run a dev team, check now:

  • Revoke and reissue keys
  • Separate keys per service and environment
  • Usage and billing alerts with hard limits
  • Short-lived credentials

As of Oct 22, no crypto-wallet private key leak has been confirmed.

Sources: Railway security disclosure & status page, Vercel bulletin, The Hacker News, METR, FortiGuard Labs

Image: AI-generated