Skip to content
unnudged
Get early access
brandCooling

Railway on X

The conversation is about one long outage and an exposure of encrypted env vars: anger at how it was handled, cancellations, migration to AWS and demands for refunds, alongside users who still call Railway the easiest place to ship and say they are staying.

First written 27 Oct · what changed · from 234 posts by 188 people

Tracking posts that say “@Railway”

Track this for your market
Posts, last 24h
49
+58%vs. previous 24h
Posts, last 7 days
429
106 in the last 72h
Velocity
61/day
7-day average
Momentum
−20%
Last 24h vs. a normal day this week

Posts per day, last 30 days

as of Nov 3, 09:00 UTC
2001000Oct 20: 9 postsOct 20Oct 21: 116 postsOct 22: 0 postsOct 23: 85 postsOct 24: 80 postsOct 25: 55 postsOct 26: 87 postsOct 26Oct 27: 106 postsOct 28: 78 postsOct 29: 93 postsOct 30: 67 postsOct 31: 40 postsNov 1: 29 postsNov 2: 56 postsNov 2

What changed

as of 27 Oct · checked once a month

First written 27 Oct. When what people say changes, it shows here.

Tone· 46 posts from 43 people· written 27 Oct

How do people feel about Railway?

Anger at how the incident was handled leads, with 18 people saying they have cancelled, migrated or lost trust. Praise of the platform itself is next, 14 people, with 7 staying loyal and 4 liking it but shaken.

18 people say they have cancelled or are migrating, that a customer since 2022 "cannot do business with a company I cannot trust", or that it was unforgivable to be told to rotate keys and then be unable to deploy. Some mock the security claim and the sign-up pause itself.

Praise is next, 14 people, and it is about the day-to-day: the CLI and dashboard, usage-based billing (one was not charged for a month with no usage), and a new activity-feed filter that makes it easy to see "who touched prod". One calls it the deployment platform of choice for new projects built with AI coding tools; another rates it good value next to AWS without a DevOps team.

7 people stay deliberately, arguing Railway is still safer and less work than hand-rolling a VPS, that it is unusually proactive on security, and that those who leave will come back. 4 like it but doubt the reliability now, including one who had recommended it widely and no longer does.

  • Furious or gone: trust broken21
  • Loves it14
  • Still loyal after the breach7
  • Satisfied but shaken4
See 5 of 46 posts
JJ Eaton@jayleaton

I was hacked when @Railway went down. I had more than 20 projects hosted on the platform. It seems the only one that was actually breached was an old app from 3-4 years ago that I coded myself before AI and hadn't updated in over 12 months. They had accessed the following keys for only this 1 project. - Supabase keys - Resend keys - AWS credentials Luckily, everything had strict usage limits in place, and I was able to rotate the keys without too much hassle. Jokes on them, though, as they sent emails to around 25k email addresses. Guess I just got a free 25k email list. ( I would never actually do this..) Railway is still an amazing solution, and these things will likely keep happening on any and all platforms. It's a good reminder to set access limits and ensure your keys/apps are secure.

Mathias Schrøder@MattiSchroder

I'm 100% sure staying on @Railway is safer than hand-rolling your own Hetzner server for your SaaS — even after their breach. I'd been thinking about moving Kleio to Hetzner for a long time. Then a guy at my co-working space told me he dropped the exact same plan for security reasons. He was simply too afraid in the age of AI. I think he's right. And even if he isn't, your time (and worry!) is better spent elsewhere than managing a VPS.

5 of the 46 posts behind this answer, one per person. The other 41, and every new one as it’s posted, come with tracking. Get early access

Pain points· 138 posts from 117 people· written 27 Oct

What do people complain about with Railway?

Outages and blocked deploys are the biggest complaint, with 48 people affected. Leaked env vars and API keys follow at 20 people, and 17 people fault the updates as much as the failure.

The largest group, 48 people, is the multi-day incident: services down for twelve hours or more and, in one account, three days, builds stuck mid-stage, and what users call "blocked deployments" lasting days. Some say they had already moved a stack to another host before it came back.

The same days brought the key exposure. Posts relay that an intruder reached customers' encrypted env vars and some were decrypted; users name OpenAI, Google AI and Anthropic keys, Supabase and Resend keys, and AWS credentials taken out of Railway environments. Bills run to $780, $800 and $1,000 of AI spend, and people with spend limits say that is what capped the damage. 12 people ask for refunds or credit, reporting the answer was no.

17 people fault the telling as much as the fault: generic status lines, no ETA, emails hours after keys were being used, and upstream providers warned before users. Rotating every secret — twice for some, a whole night for others — plus locked-out accounts, paused sign-ups, builds slowing from minutes to twelve, and a static-IP bug that blocks SSH, round out the complaints.

  • Outages and blocked deploys50
  • Poor communication and late disclosure26
  • Secrets and API keys leaked21
  • No refunds or compensation14
  • Painful key rotation9
  • Locked out: sign-ups paused, 2FA and support unreachable8
See 5 of 138 posts
Maddox Schmidlkofer@_maddox1337

@OpenAIDevs @Railway My OpenAI API key was stolen in Railway's Oct 21 env-var breach and burned ~$780 of image generation in 5 hours, draining my credits. OpenAI support is a bot loop (6 case #s) and the fraud form fails Turnstile. Can a human help? Case #18114703

Wyatt Mingji Lim@WyattMingjiLim

It's finally my turn. The @Railway hacking/breach where the hackers targeted env vars - I discovered that I am one of the victims. But instead of OpenRouter or OpenAI or Anthropic (which all i have spend limits on) - and which Railway contacted and had revoke API keys on their side.... The one that didnt do an auto revoking: Google AI's API key was that one pirated from me. My Google AI account, which I hardly used (as currently I cant find a niche for their models for me to use) - suddenly exploded in usage over the past 2 days, racking up over 800 dollars of API usage (which was actually flagged by Google AI for anomaly usage). And unfortunately, I trusted Google so much that I never set a monthly spent limit (to be honest, it rather difficult to find where to do that, since its insanely complicated and difficult to find where to set/edit anything in the Google Cloud/Platforms) - its on postpaid setting. I had immediately revoked the API key and contacted Google Support on this. Its quite a pain now to reset every single API key since my system running on Railway have ALOT of env vars. The API key was probably used for distillation attack on Gemini's models. Anyway... hope there is a positive resolution from Google.

5 of the 138 posts behind this answer, one per person. The other 133, and every new one as it’s posted, come with tracking. Get early access

Alternatives· 19 posts· written 27 Oct

What are the alternatives to Railway?

AWS is the alternative named most, by 7 people, usually as the sturdier choice for production. Render comes next at 4 people, then Vercel at 3.

AWS is the destination 7 people name, in almost every case as the move away from Railway during or after the incident: one moved an entire stack the day services went down, others call the migration a multi-day job even with AI help, and one says the episode "just makes me understand why AWS is valuable". Others put AWS, GCP and Azure on the same footing as the grown-up option.

Render, 4 people, is tried and sometimes abandoned: one started moving projects and went back, deciding they would rather wait for Railway than "suffer looking at the Render dashboard"; another says they started over on Render.

Vercel, 3 people, is named as the hobby fallback after the cheapest plan went, and one asks whether it is better and cheaper before moving. Cloudflare, 2 people, is weighed as backup infrastructure or a place to keep everything now that Railway ships a CDN. Single voices name DigitalOcean after rotating more than 50 variables, and Azure. One argues staying is safer and less work than running a Hetzner VPS.

  • AWS7
  • Render4
  • Vercel3
  • Cloudflare2
  • DigitalOcean1
  • Azure1
See 5 of 19 posts
Ali@alimahouk_

@Railway was great when i needed to quickly get off the ground. this latest incident finally pushed me to move my project to @awscloud, making it ready for proper scaling to deal with real production loads. thx railway team and good luck 🫡

Ife Ody@Ife_Ody

yes. i tried to migrate to Render but after moving my first project. I realised that i would rather wait for railway to fix their issues than suffer looking at the Render dashboard

5 of the 19 posts behind this answer, one per person. The other 14, and every new one as it’s posted, come with tracking. Get early access

Questions· 28 posts· written 27 Oct

What do people ask about Railway?

The biggest ask, from 7 people, is whether it is down and when it will be fixed. Next is the postmortem and the vulnerability itself, 6 people, then whether their own account was caught, 5 people.

Questions track the incident hour by hour. 7 people ask for status and ETAs: whether an outage is still going, whether "still working to resolve" means the cause is found, when instance builds will be allowed again, whether a new builder fixes the deploy queue, and whether a disabled command like `railway ssh` is back.

6 people want the root cause: what failed and was exploited, whether the decryption of env vars was a flaw in Railway's own system, and when the written postmortem lands, with one noting the preliminary report carried no technical detail.

5 people ask whether they were hit and how they would know: whether contact means affected, whether all five million users were, whether private parameter keys in an API connector were exposed. 3 ask when sign-ups reopen, 3 ask which host to move to, and 2 ask whether the platform is still safe to build on for years. 2 ask about regions near them, naming ap-south and India.

  • Is it down, and when will it be fixed?7
  • Where is the postmortem and what was the vulnerability?6
  • Was my account affected by the breach?5
  • When will new sign-ups open again?3
  • What is a good alternative to Railway?3
  • Is Railway still safe to build on?2
See 5 of 28 posts

5 of the 28 posts behind this answer, one per person. The other 23, and every new one as it’s posted, come with tracking. Get early access

Wishes· 10 posts from 9 people· written 27 Oct

What do people want from Railway?

The most common wish, from 3 people, is the cheap way back in: a hobby or builder plan, prepaid credits, or free credits. Regions in Asia and India follow, 2 people.

The pricing wishes are short and direct: a student says the platform is "goated" but the student budget is not, one asks for prepaid credits to return, one asks for any builder or hobby plan because GCP is a pain, and elsewhere on the page a hobbyist notes that a company advertising "stop overpaying" removed the cheapest option.

Regions are the other repeated ask, 2 people, naming a data centre in India, an ap-south-1 equivalent, and regions in Taiwan, Japan and Hong Kong.

The rest are single asks, each about a specific workflow: read-only tokens scoped to an environment so a debugging agent can read logs without wider access; usage and cost broken down per project in the mobile app, plus creating a project from the phone; one-click VM minting when a new product leaves beta; and, for someone disputing fraudulent AI spend, recovery tooling that packages the evidence token providers need so customers are not reconstructing it mid-dispute.

  • Bring back the cheap hobby tier and pre-paid credits3
  • More regions, especially Asia and India3
  • Environment-level read-only tokens1
  • Per-project usage and cost visibility1
  • One-click VM minting1
  • Help with disputes over stolen key spend1
See 5 of 10 posts

5 of the 10 posts behind this answer, one per person. The other 5, and every new one as it’s posted, come with tracking. Get early access

In their words

How do people talk about Railway?

The phrases people use most, counted once per person.

  1. 1“api key”10
  2. 2“ai spend”4
  3. 3“able to deploy”3
  4. 4“activity feed filters”3
  5. 5“keys were compromised”2
  6. 6“fraudulent ai spend”2
  7. 7“spend limits”2
  8. 8“unauthorized usage”2
  9. 9“encrypted env”2
  10. 10“dumpster fire”2

Posts are shown the way X shows them. One of them yours? Here’s why it’s shown, and how to take it off.

Also in App hosting and deploy

See all 6 in App hosting and deploy →

Get every post about Railway, filtered and labelled

This page is the summary. Tracking gives you the stream behind it for any brand, keyword or @mention: each new pain point, request and question as it’s posted, with the spam and promotions already taken out.