---
title: "Security Disclosure Recommendation: Check for Unexpected OpenAI Usage"
description: "Learn how to Security Disclosure Recommendation: Check for Unexpected OpenAI Usage"
date: 2026-10-22T00:46:08.731Z
authors: ["Mykal Machon"]
category: "Engineering"
url: https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openai-usage
---

# Security Disclosure Recommendation: Check for Unexpected OpenAI Usage

> This guide is part of Railway's response [to the security disclosure published on October 21, 2026](https://blog.railway.com/p/security-disclosure-wednesday-october-21st).

*If you use OpenAI with Railway, revoke any API key that may have been exposed, review usage for requests you didn't make, and redeploy your services with a new key.*

If you have an OpenAI API key that may have been exposed, or your spend rose without a matching change in your traffic, check your OpenAI usage. OpenAI's guidance is to delete the key, review usage, and contact support with the details.

This guide applies the guidelines from OpenAI's [Keeping your OpenAI account secure](https://help.openai.com/en/articles/8304786-keeping-your-openai-account-secure#respond-to-a-suspected-compromise), extended to include Railway-specific operations.

## Revoke the key

Deleting a key takes effect immediately. Project keys and legacy user keys live on different pages.

1. Open [API keys](https://platform.openai.com/api-keys) for the project that owns the exposed key. Select the right project in the top-left project picker first.
2. Click the trash icon next to the key and confirm.
3. If the key is an organization-level or legacy user key, delete it from [Organization API keys](https://platform.openai.com/settings/organization/api-keys) instead.
4. Click **Create new secret key** to generate a replacement in the same project. Copy it now. The dashboard doesn't show it again.
5. If an Admin key may also have been exposed, delete it from [Admin keys](https://platform.openai.com/settings/organization/admin-keys). Only organization owners can do this.

> OpenAI disables keys it finds on the public internet or inside published apps. \
> If you received that notification, the key is already dead but you still need the review below.

## Update the key on Railway

An OpenAI API key on Railway is a variable, so updating it is a variable edit and a redeploy.

1. Open the service that uses the key and click **Variables**.
2. Edit the variable to the new key, then deploy the [staged change](https://docs.railway.com/deployments/staged-changes).
3. Confirm the new deployment is active and its logs show successful requests to the API.

## Review for misuse

The usage dashboard breaks spend down by project and by key ID, so a key you don't use with a given model stands out.

1. Open [Usage](https://platform.openai.com/usage), select the affected project, and group by API key. Compare token volume, request counts, and the model mix against your normal traffic during the exposure window.
2. Open [Billing](https://platform.openai.com/settings/organization/billing/overview) to see the spend for the period and any credit grants that were consumed.
3. If your account has [audit logs](https://help.openai.com/en/articles/9687866-admin-and-audit-logs-api-for-the-api-platform) enabled, review them for key creation, member changes, and project changes you didn't make.
4. Review [Members](https://platform.openai.com/settings/organization/members) and project membership for people you didn't invite.
5. On your own account, review **Security history** and log out of all sessions if you see sign-ins you don't recognize.
6. Keep the usage details, then contact [OpenAI Support](https://help.openai.com) by opening a chat on any Help Center page.

If you have any other questions, contact Railway support at <support@railway.com>.


---

Open this post in a browser: https://blog.railway.com/p/security-disclosure-recommendation-check-for-unexpected-openai-usage