Railway says an unauthorized party may have accessed encrypted environment variables and decrypted some, with impact that "may be limited to a subset of users." Yet it tells all users to roll every variable, paused all deployments, and invalidated all API tokens. Its status page showed only an outage until the 22:10 UTC notice, and paused builds blocked applying new keys. Railway gives no count or entry point. https://blog.railway.com/p/security-disclosure-wednesday-october-21st #CloudSecurity #DevOps #InfoSec #Cybersecurity