Security Disclosure Recommendation: Check for Unexpected OpenAI Usage

Railway published a security disclosure recommendation on October 21, 2026, telling users who connect OpenAI to Railway to revoke any API key that may have been exposed, review usage for requests they did not make, and redeploy services with a new key. The guide follows OpenAI's account-security guidance and adds Railway-specific steps: delete the key from the project's API keys page or the Organization API keys page for legacy keys, replace the variable in the Railway service, deploy the staged change, then check the OpenAI usage dashboard grouped by API key for token volume, request counts and model mix against normal traffic. Railway also directs affected users to review billing, audit logs and member lists, and to contact OpenAI Support and Railway support at support@railway.com.

Security Disclosure Recommendation: Check for Unexpected OpenAI Usage This guide is part of Railway's response to the security disclosure published on October 21, 2026 https://blog.railway.com/p/security-disclosure-wednesday-october-21st . If you use OpenAI with Railway, revoke any API key that may have been exposed, review usage for requests you didn't make, and redeploy your services with a new key. If you have an OpenAI API key that may have been exposed, or your spend rose without a matching change in your traffic, check your OpenAI usage. OpenAI's guidance is to delete the key, review usage, and contact support with the details. This guide applies the guidelines from OpenAI's Keeping your OpenAI account secure https://help.openai.com/en/articles/8304786-keeping-your-openai-account-secure respond-to-a-suspected-compromise , extended to include Railway-specific operations. Revoke the key Deleting a key takes effect immediately. Project keys and legacy user keys live on different pages. 1. Open API keys https://platform.openai.com/api-keys for the project that owns the exposed key. Select the right project in the top-left project picker first. 2. Click the trash icon next to the key and confirm. 3. If the key is an organization-level or legacy user key, delete it from Organization API keys https://platform.openai.com/settings/organization/api-keys instead. 4. Click Create new secret key to generate a replacement in the same project. Copy it now. The dashboard doesn't show it again. 5. If an Admin key may also have been exposed, delete it from Admin keys https://platform.openai.com/settings/organization/admin-keys . Only organization owners can do this. OpenAI disables keys it finds on the public internet or inside published apps. If you received that notification, the key is already dead but you still need the review below. Update the key on Railway An OpenAI API key on Railway is a variable, so updating it is a variable edit and a redeploy. 1. Open the service that uses the key and click Variables . 2. Edit the variable to the new key, then deploy the staged change https://docs.railway.com/deployments/staged-changes . 3. Confirm the new deployment is active and its logs show successful requests to the API. Review for misuse The usage dashboard breaks spend down by project and by key ID, so a key you don't use with a given model stands out. 1. Open Usage https://platform.openai.com/usage , select the affected project, and group by API key. Compare token volume, request counts, and the model mix against your normal traffic during the exposure window. 2. Open Billing https://platform.openai.com/settings/organization/billing/overview to see the spend for the period and any credit grants that were consumed. 3. If your account has audit logs https://help.openai.com/en/articles/9687866-admin-and-audit-logs-api-for-the-api-platform enabled, review them for key creation, member changes, and project changes you didn't make. 4. Review Members https://platform.openai.com/settings/organization/members and project membership for people you didn't invite. 5. On your own account, review Security history and log out of all sessions if you see sign-ins you don't recognize. 6. Keep the usage details, then contact OpenAI Support https://help.openai.com by opening a chat on any Help Center page. If you have any other questions, contact Railway support at support@railway.com mailto:support@railway.com .