Railway told all users to rotate every environment variable after a breach. If your n8n runs there, start with the API keys

Railway asked every customer to rotate every secret it stores. For self-hosted automations, that is most of the keys that matter.

What happened

On October 21, Railway said it detected anomalous activity involving the systems that store customer environment variables. Its investigation so far indicates an unauthorized party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway notes those variables can hold API keys and database or registry credentials.

The company believes the breach is part of a series of attacks on platform companies aimed at compromising AI inference providers. It said the impact may be limited to a subset of users, but still recommended that all users immediately roll all environment variables, including API keys and private registry credentials, and review service logs for unusual activity. Deployments were paused during the investigation. A follow-up post on October 23 says commits pushed during the pause were not deployed and tells users to redeploy, reconnect GitHub and recreate CLI and CI credentials. TechCrunch reports Railway did not say how many users were affected or what the root cause was, and that a post-mortem is planned.

My take

Railway is a popular place to run n8n and small automation backends, and that setup puts everything in environment variables: the encryption key for stored credentials, the database password, OpenAI or Anthropic keys, CRM tokens. If your stack runs there, treat this as a rotation day, not a reading day.

Work in order of damage. First the keys that spend money (model providers), then the keys that touch client data (CRM, email, payment tools), then database and registry credentials. After each rotation, run one test execution so you find the broken workflow now, not when a client does.

The bigger fix is an inventory. Most teams cannot answer which client keys live on which platform. A simple sheet with key name, owner, where it is stored and last rotated date turns the next breach notice into an hour of work instead of a weekend. Where the provider allows it, use scoped keys per client and per workflow so one leak does not open every account.

If you want help mapping and rotating the keys behind your automations, send me a message at romielwillautomate.dev.