Railway security incident report
Last updated: 24 October 2026. We want to explain, with full transparency, what happened, which parts of the website were affected, what we did and what we are still doing.
- What happened
- What was affected
- What was not affected
- Timeline
- Measures taken
- What we are still doing
- Do you need to do anything?
What happened
Railway, the provider where we host the website's backend, reported a security incident through official channels. According to its statement, an unauthorised third party may have accessed some customers' encrypted environment variables and, in some cases, obtained their decrypted contents. These variables can contain API keys and database credentials.
Our backend powers the dashboard, the statistics, Discord login and the server side of the support chat. As a precaution, we treated all credentials stored there as potentially exposed, although we have no evidence that they were misused.
You can check the provider's official status at status.railway.com.
What was affected
- Backend credentials: the access keys for the database, the support chat service, website sessions, bot synchronisation, the admin panel and the alert system were stored on Railway and have been renewed.
- Dashboard and statistics: while Railway had deployments paused, we could not publish backend fixes and these sections could fail or lag behind.
- Sessions: renewing the session signing key invalidated all open sessions, so you need to log in again with Discord.
- Brief backend restarts: during the credential change, the backend restarted briefly until all the new keys were applied.
What was not affected
- The Discord bot kept working normally: it does not depend on Railway to operate.
- The public part of the website (pages, documentation, commands) is hosted separately and contains no secrets.
- Patreon credentials were not stored on Railway.
- Your passwords: FireFighter does not have your Discord password. Login uses Discord OAuth2 and never goes through our servers.
Timeline
| When | What happened |
|---|---|
| Early hours of 22/10 | Railway reports the incident by official email and temporarily pauses deployments. |
| Morning of 22/10 | We publish a statement on our Discord and a notice on the website. We start preparing the credential renewal. |
| During the day | Railway restores deployments. We renew all credentials, deploy the backend with the new keys and retire the old ones. |
| Afternoon of 22/10 | We verify every service, review the logs and mark the incident as resolved. We remove the website notice and publish this report. |
| 23/10 | Railway publishes its preliminary report: our workspace is not among the higher-risk ones. Since the credentials had already been rotated and revoked, the rotation does not need to be repeated. |
Measures taken
Following Railway's recommendations, we revoked and replaced all the keys stored in its environment variables:
- Database: new access password and new connection string. The previous one is no longer valid.
- Support chat: new service key. The previous one has been invalidated.
- Website sessions: new signing key.
- Bot ↔ backend synchronisation: new shared secret, applied on both sides.
- Admin panel: new access key for the team.
- Alert system: new webhook; the previous one has been deleted.
- Bot and Discord application: token and OAuth2 credentials regenerated.
We also reviewed the logs of the database, the support chat and the servers, and detected no unusual activity.
What we are still doing
- Continuous monitoring of the logs over the coming days.
- Stronger protections for the backend and the website as a result of this incident.
- Railway's report: on 23 October Railway published its preliminary report. Our workspace is not among the higher-risk ones, and the credentials had already been rotated and revoked, so the rotation does not need to be repeated. We keep monitoring for any suspicious activity.
These are the protections we already had in place and continue to maintain:
- Detection and logging of attack attempts (scans, injections, unauthorised access).
- Automatic blocking of repeat-offender IPs and real-time alerts to the team.
- End-to-end encryption in the support chat.
- Hardened security headers and rate limits against abuse.
Do you need to do anything?
- Log in again to the dashboard if it asks you to. This is an expected effect of the key renewal.
- Be wary of direct messages from people pretending to be us. We will never ask you for passwords or tokens by direct message.
- If you notice anything strange on the website or the dashboard, let us know through the support chat or at support@firefighterbot.xyz.
You can see the rest of that day's changes in Snapshot 26Fire0001. If you have found a vulnerability, see our security and vulnerability reporting page.