Secrets are the new target

Last night I got an email from Railway, the deployment platform. Someone got into the systems that store customer environment variables, and for some customers they got the decrypted values too. That means API keys, database passwords, registry credentials. Railway paused all deployments and asked everyone to rotate their secrets.

If you’re on Railway, stop reading and go rotate everything. I’ll wait.

Why this one stuck with me

Incidents happen to every platform, and to be fair Railway’s communication was fast and clear. What stuck with me was one line in their disclosure: they believe it’s part of a series of attacks on platform companies, aimed at getting access to AI inference providers.

That makes total sense when you think about it. A model API key with a big quota is basically cash. You can resell the access, run your own workloads on someone else’s bill, or burn through a company’s budget in a few hours. Five years ago an attacker wanted your database. Today your AI keys are just as interesting, and they’re usually guarded a lot less carefully.

Four questions I’d check this week

Whatever platform you’re on, these are worth an hour of your team’s time.

1. Where do your AI keys actually live? One secret store, or copied into ten places: CI variables, a few laptops, an old staging server, a notebook someone shared once. You can’t protect what you can’t list.

2. Do they have spend limits and alerts? Most providers let you cap spend per key or per project and alert on spikes. A stolen key with no limit is a very expensive morning. A stolen key with a limit and an alert is an annoying one.

3. Can you rotate every secret in under an hour? This is the real test. If rotating means hunting through repos and asking “who set this up?”, the gap isn’t the leak, it’s the process. Write the runbook now, while nothing is on fire.

4. Do your agents and pipelines use short-lived tokens? As more agents run in CI and touch production, the old habit of one long-lived key for everything gets riskier. Short-lived tokens, scoped per job, limit the damage when something leaks.

The bigger point

We spent the last two years making it easy to plug AI into everything. That was the right call. But every integration came with a key, and those keys now sit next to the most sensitive things we own. Security for the AI era isn’t only about prompt injection and model behaviour. A lot of it is the boring stuff, done properly: knowing where your secrets are, limiting what they can do, and being able to change them fast.

When did you last rotate yours?