Security Disclosure Recommendation: Check for Anomalous GitHub Access

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you connect GitHub to Railway, review your security log, authorized apps, and keys for access you didn't grant, then confirm nothing unexpected reached your deployments.

If a GitHub token, SSH key, or password stored in Railway variables may have been exposed, or Railway deployed a commit you don't recognize, check for anomalous GitHub access. Work through the GitHub checks first, then the Railway checks. Revoke anything you don't recognize as you go.

Review your personal account

GitHub logs security-relevant actions on your account for 90 days, and every integration or key.

1. Open your security log. Filter with operation:authentication for sign-ins and operation:access for resource access. The oauth_authorization, public_key, personal_access_token, and repo categories cover the common ways an attacker gains persistence. See Reviewing your security log.
2. Review authorized OAuth apps and authorized GitHub Apps. Revoke anything you don't recognize, and anything with private repository access that doesn't need it.
3. Review SSH and GPG keys and delete keys you didn't add.
4. Review personal access tokens, including fine-grained tokens. Delete tokens you don't recognize and regenerate all tokens

Review your organization

Organization owners have a separate audit log that covers every member's actions on organization resources for 180 days.

1. Open the organization's Settings, expand Logs, and click Audit log. See Reviewing the audit log for your organization.
2. Export the filtered log as JSON or CSV before you revoke anything, so the evidence survives credential deletion.
3. Review Third-party access in the organization's settings for OAuth apps and GitHub Apps you didn't approve.
4. For each affected repository, review Deploy keys, Secrets and variables, Webhooks, and Collaborators under the repository's Settings. An attacker with push access can add a webhook or secret that outlives a password reset.

If you have any other questions, contact Railway support at support@railway.com.