Railway has been compromised!!! If you use OpenAI, Anthropic/claude, OpenRouter and stripe READ THIER STATEMENT: But Here are the main risks and bad outcomes based on Railway’s official disclosure and user reports: • API key draining and unexpected charges, Attackers have already been actively using exposed keys, This can burn through AI credits or generate real billing charges in MINUTES • Database and data access: Environment variables often include database credentials. Compromised ones can allow attackers to read, modify, or delete your data, or dump entire databases. • Private registry/image compromise. Registry credentials (Docker Hub, GHCR, etc.) can let attackers pull your private images or push malicious ones, potentially leading to supply chain attacks • Lateral movement into other services. Broad or high privilege keys can give attackers access to connected systems (cloud accounts, third-party APIs, email, analytics, payment processors, etc.), expanding the blast radius beyond Railway What to do; Rotate all environment variables and private registry credentials stored in Railway, then review logs of the related services for suspicious activity Stay safe