Seen multiple folks in the Railway Discord confirming that their secrets stored in Railway have been used by third parties, so it definitely sounds like the attackers were able to read decrypted environment variables.

▲

numbsafari 25 minutes ago | parent [-]

Environment variables are a terrible place to store secrets.

I'm just going to say it, since having said it non-stop for over 20 years, nobody seems to listen and we keep circling this drain.

The 12 Factor manifesto was 100% wrong on this point.

Use environment variables to point to where secrets are located, not to store their values.

	▲	tptacek 15 minutes ago \| parent \| next [-]
		Environment variables are generally fine for secrets. Environment files are problematic. Modern systems that inject secrets into the environment launch the program itself.
	▲	zaik 17 minutes ago \| parent \| prev [-]
		systemd makes it easy: https://systemd.io/CREDENTIALS/