Security
Breaches, attacks and emergency patches, quoted from each provider's status page.
Days without a breach
Days since the last breach anywhere was resolved.Breaches, 12 mo
Someone got in or secrets got out: unauthorized access, leaked credentials, keys to rotate. Adds 600 points.Attacks, 12 mo
DDoS, abuse or malicious traffic that hurt the service. Graded by impact like any outage.Patches, 12 mo
Downtime from fixing a vulnerability: emergency reboots, CVE mitigations. Graded by impact.Oct 20264 incidents
Oct 30BREACHSEV 2Northflank · Security incidentNorthflank detected a threat alert and found attackers may have decrypted customer environment variables. Users were told to rotate all secrets and disable public addon access. Users reported unauthorized use of AI API keys stored on the platform. Secret rotation was enabled for Postgres and MongoDB, and audit logs were enabled for all customers. Investigation is ongoing and the incident remains open.Hosting · sourceopen 19h 16m
Oct 26BREACH · FOLLOW-UPSEV 4Railway · Railway Recovery after October 21 IncidentFollow-up to the October 21 security incident. Railway says it is still recovering systems and forensic work continues. New signups remain paused with no reopening date, and updates are posted daily. The text does not say existing customer services are back to normal.Hosting · sourceopen 4d 13h
Oct 24BREACH · FOLLOW-UPSEV 4Railway · Clarification: Recent Oct 24 API key revocations are precautionaryRailway clarified that AI providers revoked some replacement API keys created after the October 21 incident. The revocations were precautionary, caused by Railway giving providers a batch that included newer keys. Affected customers must create new keys, update Railway variables, and redeploy. Railway says it is not under a new attack and that existing working keys need no further rotation.Hosting · source16h 33m
Oct 21BREACHSEV 2Railway · Railway Platform OutageA security incident halted builds for all Railway plans from October 21. Builds were restored in stages to all plans by October 22, with slow builds and US West deployment failures meanwhile. Customers with exposed credentials were notified; rotation advised. Signups remain paused and the community site is still down.Hosting · source2d 14h