21–22 October 2026

Which keys to rotate

This list follows Railway's own posts about the October 2026 incident. It is not a claim that your project was in the affected set. The free scan looks at the public JavaScript for a Clerk secret assignment and for an OpenAI key. It does not read Railway's environment.

  1. 01

    Sensitive variables stored on Railway

    Railway's 21 October 2026 disclosure says an unauthorized party may have accessed encrypted environment variables and, for some of them, the decrypted contents. They recommend that every user roll sensitive variables stored on Railway, including API keys, database credentials, and private registry credentials, and review those services' logs. Their preliminary report says the query of encrypted variables cannot by itself name which keys were decrypted.

  2. 02

    PostgreSQL on Railway

    Railway's 22 October 2026 database guide says to open the PostgreSQL service, Database, Config, and Regenerate. That changes the password inside Postgres and the template variables that reference it. Then redeploy every service that uses the database. Do not hand-edit POSTGRES_PASSWORD and do not run ALTER USER yourself. A pasted connection string does not pick up the new password until you replace it.

  3. 03

    Copies that do not live on Railway

    Regenerating a variable on Railway does not revoke a copy you pasted into Vercel, Supabase, CI, or a laptop. If DATABASE_URL, a Stripe secret, an OpenAI key, a Clerk secret, a Supabase service role, or a Neon connection string was stored on Railway, rotate it at the provider that issued it and put the new value only in server-side env.

  4. 04

    What not to rotate because of this incident

    Publishable values are meant for the browser: a Supabase anon or sb_publishable key, a Clerk pk_test_ or pk_live_ key, and a Firebase web API key. Rotating those does not close a database that has no row ownership check. A Clerk sk_live_ or sk_test_ next to CLERK_SECRET_KEY is a secret. A bare sk_live_ with no Clerk assignment is Stripe's prefix, not Clerk's.