> Why did Railway not notify customers of potentially decrypted keys sooner? ... we wanted to ensure the attacker was ejected from our running infrastructure before telling users to roll their credentials, to prevent the credentials from becoming immediately compromised again.
The way this was handled is messed up to the point it's starting to sound hilarious, they could've easily let people know ASAP that the keys were compromised so they can disable them early and Railway could temporarily block them from updating secrets to keep them secure all around in the meantime
The way this was handled is messed up to the point it's starting to sound hilarious, they could've easily let people know ASAP that the keys were compromised so they can disable them early and Railway could temporarily block them from updating secrets to keep them secure all around in the meantime