If you’re a Railway user acting on today’s security incident, here are some best next steps: > Rotate any potentially exposed secrets and credentials > Review audit logs for suspicious access > Set up automated rotation for DB credentials and API keys > Use short-lived, dynamic credentials wherever possible > Consider fetching secrets at runtime instead of storing them directly in Railway @infisical supports automated rotation for 50+ secret types, dynamic secrets, and Railway secret sync if you need a place to start.

over the past few weeks, we leaked thousands of API keys across the NYC subway! please don't try this at home.