Railway alternatives after the October 2026 security breach: rotate first, then compare secrets

Railway alternatives only help after you rotate. Railway said on October 21, 2026 that an unauthorized party may have read encrypted environment variables and, for some, their decrypted values, so treat every key you stored there as exposed. This guide covers what to rotate first, then compares six platforms on how they hold secrets, not just on price.

Moving your app does not un-leak a key. A new host only changes what happens the next time something goes wrong, so the useful comparison is how each platform stores, shows and scopes the credentials your app depends on. Prices and plans below were checked on each vendor's own site in October 2026.

Was Railway hacked? What the disclosure says and what it leaves out

Yes. Railway's security disclosure of October 21, 2026 says it detected anomalous activity affecting the systems that store customer environment variables, and that an unauthorized third party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents." Those variables, Railway notes, may hold API keys and database and registry credentials.

Railway says its initial analysis suggests the impact may be limited to a subset of users, but it recommends every user roll all environment variables and private registry credentials, then review service logs for unusual activity. It believes the intrusion is part of a series of attacks on platform companies aimed at compromising AI inference providers, and says it notified those upstream providers to revoke keys proactively.

The disclosure does not say how the attacker got in or how many customers were affected. Railway says it will email affected customers as it confirms them and update the post and its status page as it narrows the scope. Until then, anything more specific is guesswork, and we have left it out.

The Railway incident page records the clean-up so far:

• October 21, 20:30 UTC: OAuth sessions invalidated, so users had to sign in again.
• October 21, 22:10 UTC: Railway began rotating all of its bucket credentials.
• October 22, 04:17 UTC: all Railway API tokens invalidated; tokens created before the incident stay invalid.
• October 22, 19:06 UTC: new signups paused to prioritize existing customers.
• October 22, 20:29 UTC: Pro and Enterprise builds and deployments running normally, with Hobby still being enabled, followed by Free and Trial.

What to do after the Railway security breach: rotate in order of damage

Rotate the keys that can cost you the most first. Railway's disclosure names the scope as all environment variables plus private registry credentials, so the list below is about order, not about skipping anything.

1. Cloud provider keys. An AWS access key or Google Cloud service account key can create servers, read buckets and run up a bill. Railway's guide for exposed AWS keys says to create a replacement first, then deactivate the old key rather than delete it, so you can briefly reactivate it if something breaks. Its companion Google Cloud guide warns that service account keys don't expire by default, so an exposed key works until you disable it.
2. AI provider API keys. Railway says it asked upstream providers to revoke keys, but issue new keys yourself and confirm the old ones are dead in each provider's console.
3. Database and registry credentials. Change the password at the database or registry, then update the variable.
4. Payment, email and third-party SaaS keys. Anything that can send money or messages in your name.
5. Railway's own tokens. Railway has already invalidated API tokens and rotated bucket credentials, so create new API tokens and redeploy to pick up the new bucket credentials.

Then look for misuse. Railway's AWS guide points out that CloudTrail Event history keeps 90 days of management API calls and is per Region, so search every Region for calls such as RunInstances, CreateUser and CreateAccessKey made with the exposed key. Check billing against last month as well.

How do I rotate my Railway environment variables?

Rotate at the source first, then in Railway. Issue the new credential at the provider, replace the value in the service's variables (a shared variable is edited once in Project Settings), deploy, and confirm the logs show successful calls before deactivating the old credential. Railway's AWS guide lists InvalidClientTokenId and SignatureDoesNotMatch as the errors that mean the new key is not in place.

The catch is deploys. As of the last status update we read, Hobby builds were still being re-enabled and Free and Trial builds came after them, so some teams cannot ship a new value yet. If you are in that position, you are choosing between a few hours of downtime and leaving an exposed key live. For a key that can spend money or read customer data, the downtime is usually the smaller loss.

Should I leave Railway?

Not because of this incident alone, and not before you rotate. The strongest case for staying is that every platform on this list has to decrypt your secrets to hand them to your running app, and Railway already offers sealed variables, whose values are never shown in the UI or returned by the API or CLI. The disclosure does not say whether sealed variables were treated differently in this incident, so do not assume either way.

The case for leaving is about information and control. Railway has not yet published how the attacker got in. If your security review needs a root cause before you can sign off, or a customer contract requires it, that is a legitimate reason to plan a move while you wait.

Whichever way you go, judge the next platform on three questions:

• Can a saved secret be read back from the dashboard, API or CLI? Write-only values limit what a stolen session or token can show.
• Can your app use short-lived cloud credentials through OIDC (OpenID Connect, a way for the platform to vouch for your app so AWS or Google issues temporary keys) instead of long-lived keys stored as variables?
• Can production secrets be separated from preview and development?

Railway alternatives compared on how they handle secrets

The table summarizes what each vendor's docs and pricing pages say as of October 2026. A dash means the docs we read did not cover it, not that the feature is missing.

Render vs Railway

Render is the closest like-for-like move: web services, workers, cron jobs and managed Postgres in one place. According to Render's pricing page, the Hobby workspace is $0 plus compute, Pro is $25 a month plus compute, and the smallest paid web service is $7 a month. Render's docs say free web services spin down after 15 minutes without traffic and free Postgres databases expire 30 days after creation.

On secrets, Render groups variables into environment groups that can be scoped to a project environment such as production. Render's changelog says OIDC authentication for AWS became generally available for Pro workspaces and higher on July 15, 2026. Skip Render if you need to stay on the free plan for a production app; the spin-down and database expiry rule that out.

Fly.io vs Railway

Fly.io has the most explicit secrets design of the group. Its secrets documentation says secrets go into an encrypted vault, that its API servers "can only encrypt; they cannot decrypt secret values," and that plain-text values cannot be read back. A host-side agent decrypts them and injects them when a machine boots. Fly also supports OIDC, and its docs say third-party credentials issued that way are valid for 15 minutes.

The catch is cost and effort. Fly's pricing docs say new organizations get no free tier or monthly free allowance, only a trial of up to two hours of machine runtime or seven days. A shared-cpu-1x machine with 256MB starts at $2.19 a month, but Managed Postgres starts at $38 a month. Skip Fly.io if you want a free tier for side projects or cheap managed Postgres.

Vercel

Vercel's environment variable docs split variables into Config and Secret types; Secret values are write-only after saving, and an optional team policy forces production secrets to differ from preview and development values. Vercel's OIDC federation, available on all plans, lets functions exchange a short-lived token for AWS, Google Cloud or Azure credentials.

Vercel's pricing page lists Hobby at $0 and Pro at $20 a month, and says Hobby is for personal, non-commercial use. Skip Vercel's Hobby plan for anything commercial; its own pricing FAQ rules that out.

Heroku and the cheapest Heroku-style hosting

On price, Heroku is close to the cheapest option here. Its pricing page lists Eco dynos at $5 a month, which sleep after 30 minutes of inactivity, Basic dynos at $7 and Essential-0 Postgres at $5. The pricing page lists no free plan.

On secrets, Heroku is the weakest fit for this particular worry. Its config vars documentation shows heroku config printing every value, and the docs do not describe encryption at rest. If unreadable secrets are your reason to move, skip Heroku.

DigitalOcean App Platform

DigitalOcean's App Platform pricing lists a free tier of three static-site apps, paid apps from $5 a month, and a $7 development database with 512 MiB of RAM that is not backed up by default and is deleted with its app. It is a sensible step for teams that already run Droplets or managed databases there.

Its environment variable docs offer an Encrypt option that hides values from build, deploy and application logs, but they also say a team member could use the console to view an encrypted variable, and recommend limiting Owner and Member roles. Skip it if you need write-only secrets.

Coolify for self-hosting

Coolify describes itself as an open-source, self-hostable alternative to Vercel, Heroku, Netlify and Railway. Its pricing page lists self-hosting as free forever, with Coolify Cloud at $5 a month for two servers plus $3 per extra server. Self-hosting means your secrets sit on infrastructure you control, which removes one shared platform from your risk.

It also moves patching, backups and monitoring onto you. Coolify's docs let you keep a variable out of the build or out of the running container, and recommend Docker BuildKit secrets because ordinary build arguments can appear in image metadata. Skip Coolify if nobody on your team wants to run servers.

Railway alternative for Postgres hosting

If the database is what keeps you on Railway, compare it separately. From the pricing pages above: Render Postgres from $6 a month (free databases expire after 30 days), Heroku Essential-0 at $5, DigitalOcean's development database at $7, and Fly.io Managed Postgres from $38. We list 247 products in Databases & Infrastructure as of October 2026 if you want a dedicated database host.

Move the secrets before you move the platform

A secrets manager makes the next rotation one change instead of one per service. Doppler says its Developer plan is free for three users with up to 10 projects and 5 config syncs, and Team is $21 per user a month. Infisical offers a free plan with 5 identities and 3 environments per project, Pro at $23 per identity monthly, and an MIT-licensed core that is free to self-host.

Neither removes the exposure on its own. If a secrets manager syncs values into your host as environment variables, the host still holds them. The win is speed: when the next disclosure lands, you rotate in one place and every service picks it up.

Your next step

Rotate today, starting with cloud and AI provider keys, and check CloudTrail or Cloud Audit Logs for the exposure window. Then pick one platform from the table and move a single non-critical service as a test before deciding on the rest. You can compare these hosts side by side, with pricing and similar products, in Developer Tooling, where we list 491 products as of October 2026.