# What to do after the Railway hack From Preston (@quickfinesse): https://quickfinesse.dev/videos/2026-10-21-railway-breach Video: https://www.tiktok.com/@quickfinesse/video/7699300537140792606, posted October 21, 2026 ## What I'd like help with I watched this video and want to try it. Walk me through it one step at a time, and check the official links below before giving exact commands, since they change. ## In plain English Railway, the cloud host over 2 million developers use, says an attacker got customers' decrypted environment variables. Builds are still paused and people are already seeing their keys used. Would you still host on Railway? ## What was used - Railway's security disclosure (Site): https://blog.railway.com/p/security-disclosure-wednesday-october-21st - Railway status and guides (Site): https://status.railway.com/incident/QH8L8B3E ## Credits Footage: Railway's own product videos. Posts: Nevo David (Postiz) and Railway on X, and Hacker News commenters. Sources: Railway's disclosure and status page, Fireworks AI's bulletin, TechCrunch and The Hacker News. The full guide for this video is on the page: https://quickfinesse.dev/videos/2026-10-21-railway-breach # What to do about the Railway breach > From Preston (@quickfinesse) > Railway says an attacker read some customers' environment variables, the API keys and passwords their apps run on. Here's what happened, what's still unknown and what to do if your app runs there. > Page: https://quickfinesse.dev/videos/2026-10-21-railway-breach > Updated: October 22, 2026, 7:44 AM ET > Video: https://www.tiktok.com/@quickfinesse/video/7699300537140792606 ## What I'd like help with I watched this video and want to try it. Walk me through it one step at a time, and check the official links below before giving exact commands, since they change. ## The short version Railway is a cloud where developers put their apps online, with more than 2 million users. On October 21, it said someone got into the systems that store its customers' environment variables and, for some of them, read the decrypted values. Environment variables are where an app keeps its secrets, like API keys for OpenAI and Stripe, database passwords and logins for private code registries. Whoever reads them can act as your app. Railway is asking every customer to replace every variable they store there and to check their logs. It says the impact may be limited to some users, and it will email the accounts it confirms were affected. Railway paused every deploy for most of a day while it investigated. Builds came back for Enterprise and Pro workspaces overnight. Hobby, Free and Trial are still waiting, and new keys can't reach an app on those plans until they return. Railway also cancelled every Railway API token, so anything that talks to the Railway API needs a new one. If your app runs on Railway: - Treat every key in its variables as known to someone else until you replace it. - Changing a value inside Railway doesn't stop the old key. Revoke it at the service that issued it. - Check your AI and payment accounts for charges you don't recognise. - Make a new Railway API token if a script or CI job uses one. The old ones stopped working at 12:39 AM ET on October 22. ## How the day went - Oct 21 3:24 AM: Railway opens an incident. Its status page starts investigating an issue. Later updates say the dashboard, API and CLI are unavailable and new builds are paused in every region. - 5:11 PM: Postiz goes offline. Nevo David, who runs the social media app Postiz, shuts it down for every customer after Anthropic and Stripe email him that his keys were compromised. - 5:51 PM: Railway's warning. Railway posts an urgent notice on X, linking its security disclosure. - 6:10 PM: Bucket keys replaced. Railway starts rotating every storage bucket credential. The new ones appear in the dashboard, but apps can't pick them up until deploys return. The resets show in audit logs under a Railway employee's name, which Railway says is expected. - 8:22 PM: Deploys still paused. Railway says it's still working to bring builds back and will publish guides for the next steps. - 9:22 PM: Guides published. Railway posts step-by-step guides, like checking for unexpected OpenAI or Anthropic usage and rotating PostgreSQL credentials. Steps that need a redeploy still have to wait for builds. - 11:32 PM: Enterprise builds return. Enterprise workspaces can deploy again and apply the new keys they added in Railway. - Oct 22 12:39 AM: Railway API tokens cancelled. Railway invalidates all of its own API tokens. Anything using the Railway API stops working until it gets a new token. - 3:11 AM: Pro builds return. Pro workspaces can now finish the guide steps that need a redeploy. Hobby, then Free and Trial come next. - 6:15 AM: Deploys stuck in a queue. Many deploys wait longer than usual and some builds fail more often. Railway asks people not to start the same deploy twice. Hobby, Free and Trial still can't build. ## What to do if your app runs on Railway 1. List every secret your app uses. Open the Variables tab of each service, or your own .env file, and write down every key, token and password. Include database URLs and private registry logins. https://docs.railway.com/guides/variables 2. Revoke each key where it was made. Make a new key in the service that issued it (OpenAI, Anthropic, Stripe, GitHub, your database) and delete or expire the old one there. A new value in Railway alone leaves the old key working. https://help.openai.com/en/articles/9186755-managing-projects-in-the-api-platform https://docs.stripe.com/keys 3. On Stripe, expire the old key now. When you rotate a Stripe key, the old one keeps working for up to 7 days unless you pick Now as its expiration. For a leaked key, pick Now. https://docs.stripe.com/keys#rolling-keys 4. Decide what can go down. On a plan that can't build yet, a revoked key breaks a live app that still uses it until you can redeploy. I'd still revoke AI and payment keys right away. A few hours offline costs less than a stranger spending on your account. 5. Check your bills and logs. Look at usage on every AI account from October 21, and from October 16 if you saved keys in OpenCode Console. Read your service logs for anything you don't recognise. https://blog.railway.com/p/security-disclosure-wednesday-october-21st https://status.railway.com/incident/QH8L8B3E 6. Set a hard spending limit on AI accounts. In the Claude Console, set a spend limit on the Billing page and requests stop when you reach it. In OpenAI, a project's monthly spend limit only sends alerts unless you enforce it as a hard limit. https://platform.claude.com/docs/en/api/rate-limits https://help.openai.com/en/articles/9186755-managing-projects-in-the-api-platform 7. Make a new Railway API token. Railway cancelled every Railway API token. If a script, CI job or tool talks to the Railway API, make a new token in your account settings and swap it in. https://docs.railway.com/integrations/api 8. Redeploy with the new keys. Enterprise and Pro can redeploy now. Hobby comes next, then Free and Trial. Start each deploy once and let it wait in the queue, since Railway says repeats make the wait longer. https://status.railway.com/incident/QH8L8B3E ## Railway's own guides 1. Check your AI accounts for usage you didn't make. Railway wrote one each for OpenAI, Anthropic, OpenRouter and Grok. https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openai-usage https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-anthropic-usage https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openrouter-usage https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-grok-usage 2. Check Stripe, GitHub and your cloud accounts. Look for charges, access or activity you don't recognise. https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-usage-in-stripe https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-github-access https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-aws-access https://blog.railway.com/p/security-disclosure-recommendation-check-for-anomalous-gcp-access 3. Rotate your database credentials. Railway has a guide for each database it hosts. https://blog.railway.com/p/security-disclosure-recommendation-rotate-postgresql-database-credentials https://blog.railway.com/p/security-disclosure-recommendation-rotate-mysql-database-credentials https://blog.railway.com/p/security-disclosure-recommendation-rotate-mongodb-database-credentials https://blog.railway.com/p/security-disclosure-recommendation-rotate-redis-database-credentials 4. Redeploy buckets and reconnect GitHub. Railway reset storage bucket credentials, so buckets need a redeploy and GitHub needs reconnecting. https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset ## Why someone wants your AI keys Railway believes this is part of a series of attacks on platform companies, aimed at getting into AI providers. It has told those providers to revoke keys. On October 6, Fireworks AI, which runs AI models for developers, found that someone had used internal Fireworks credentials to read environment variables in some customers' evaluation jobs, including API keys and tokens. On October 16, OpenCode Console, where people could save their AI provider keys, leaked keys for 1.4% of its users. People reported charges they didn't make on OpenAI, Anthropic and Google, one totalling $1,700. Keys kept in the OpenCode app on people's own computers weren't affected. A working AI key is spending money. Whoever holds it runs models on your bill, so any service that stores a lot of them is worth breaking into. ## Posts and coverage - **The Hacker News thread** (oct 21): Developers comparing notes, including keys only stored in Railway being used. https://news.ycombinator.com/item?id=50188228 - **Railway's notice on X** (oct 21, 5:51 pm): Railway's urgent notice, linking its security disclosure. https://x.com/Railway/status/2113025284148715845 - **Postiz founder on X** (oct 21, 5:11 pm): Nevo David shuts Postiz down after Anthropic and Stripe email him about his keys. https://x.com/wickedguro/status/2113015432974405658 - **The Hacker News on OpenCode** (oct 19): Which keys leaked, the charges users reported and why local keys were safe. https://thehackernews.com/2026/10/opencode-console-breach-may-have.html - **TechCrunch on OpenCode** (oct 19): Published three days after the October 16 breach, on how OpenCode's Console leak ran up charges on users' AI accounts. https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/ - **Fireworks AI's bulletin** (oct 6): Fireworks' own write-up of the October 6 incident and what customers should rotate. https://fireworks.ai/security/bulletins/october-2026-security-incident ## Keeping keys safer from here Give each app its own key, so one leak means replacing one key. Stripe recommends restricted keys, which carry only the permissions an app needs, over full secret keys. Stripe can also lock a key to your own servers with an access policy, and it notifies you when it blocks a request from somewhere else. Railway has sealed variables, whose values reach your app but never show in the dashboard or the API. Railway hasn't said whether sealed variables were safe in this breach, so replace those too. Set spending limits on AI accounts before you need them. Read Railway's disclosure: https://blog.railway.com/p/security-disclosure-wednesday-october-21st Not known yet: - How many customers were affected. Railway says the impact may be limited to some users. - How the attacker got in. - Whether sealed variables were read. - When Hobby, Free and Trial builds come back.