Security Disclosure Recommendation: Check for Unexpected OpenAI Usage

Author: Mykal Machon

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you use OpenAI with Railway, revoke any API key that may have been exposed, review usage for requests you didn't make, and redeploy your services with a new key.

If you have an OpenAI API key that may have been exposed, or your spend rose without a matching change in your traffic, check your OpenAI usage. OpenAI's guidance is to delete the key, review usage, and contact support with the details.

This guide applies the guidelines from OpenAI's Keeping your OpenAI account secure, extended to include Railway-specific operations.

## Revoke the key

Deleting a key takes effect immediately. Project keys and legacy user keys live on different pages.

1. Open API keys for the project that owns the exposed key. Select the right project in the top-left project picker first.
2. Click the trash icon next to the key and confirm.
3. If the key is an organization-level or legacy user key, delete it from Organization API keys instead.
4. Click Create new secret key to generate a replacement in the same project. Copy it now. The dashboard doesn't show it again.
5. If an Admin key may also have been exposed, delete it from Admin keys. Only organization owners can do this.

OpenAI disables keys it finds on the public internet or inside published apps.
If you received that notification, the key is already dead but you still need the review below.

## Update the key on Railway

An OpenAI API key on Railway is a variable, so updating it is a variable edit and a redeploy.

1. Open the service that uses the key and click Variables.
2. Edit the variable to the new key, then deploy the staged change.
3. Confirm the new deployment is active and its logs show successful requests to the API.

## Review for misuse

The usage dashboard breaks spend down by project and by key ID, so a key you don't use with a given model stands out.

1. Open Usage, select the affected project, and group by API key. Compare token volume, request counts, and the model mix against your normal traffic during the exposure window.
2. Open Billing to see the spend for the period and any credit grants that were consumed.
3. If your account has audit logs enabled, review them for key creation, member changes, and project changes you didn't make.
4. Review Members and project membership for people you didn't invite.
5. On your own account, review Security history and log out of all sessions if you see sign-ins you don't recognize.
6. Keep the usage details, then contact OpenAI Support by opening a chat on any Help Center page.

If you have any other questions, contact Railway support at [email protected].