On Railway? Hackers may have your AI keys. Devs are already finding theirs in use 👇 On Oct 21, Railway said an attacker may have read customers' environment variables, which is where your API keys live. Within hours, devs on Hacker News were reporting their OpenRouter and Anthropic keys being used. A stolen key keeps working until you replace it. Here's the fix: Make a new key at your AI provider Delete the old one Paste the new one into Railway → Variables, then deploy Set a monthly spending limit on the key Then open your app and test it. One dev's new key didn't go live after the update. Railway's own advice is to roll every secret, not just AI keys: your database URL, Stripe and the rest. "Spend limits saved me," one dev wrote. Their key hit its cap in a day. With a limit, the next leak costs you the limit and nothing more. Send this to anyone deploying on Railway. Sources: Railway's security disclosure (Oct 21) and key guide (Oct 22), and the Hacker News thread under the disclosure. #vibecoding #apisecurity #railwayapp #indiehackers