Alchemy urges API key rotation after Railway security disclosure
Alchemy is advising customers who store their Alchemy API keys in Railway to rotate them, following Railway's security disclosure that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Alchemy posted the warning as a public service announcement on X with a link to its key-rotation guide and to Railway's disclosure.
Alchemy also clarified that it does not use Railway internally in any of its systems, noting the reminder applies to customers who manage their own API keys on Railway. Railway itself urged all customers to rotate environment variables, API keys, database credentials, and private registry authentication details as a precaution.
- The rotation warning covers any Alchemy API keys held in Railway, not Alchemy's own infrastructure
- Railway's investigation indicated a subset of encrypted secrets may have been decrypted
Sources
- FYI: We do not use Railway internally in any of our systems. This reminder is for any customer that uses Railway for the management of their own API keys. Thanks for staying safe, builders! Replying to their earlier post: For more info, read the security disclosure from Railway: https://t.co/hDkZBg3BEjx.com ↗
- For more info, read the security disclosure from Railway: https://t.co/hDkZBg3BEj Replying to their earlier post: 🔐 Friendly PSA: If you use Railway to store your Alchemy API keys, make sure to rotate them. Here's how: https://t.co/16yIRO8FbUx.com ↗
- 🔐 Friendly PSA: If you use Railway to store your Alchemy API keys, make sure to rotate them. Here's how: https://t.co/16yIRO8FbUx.com ↗
Alchemy
The web3 developer platform The most powerful set of web3 APIs to build and scale your dapp with ease
