What the platforms confirmed
Zeabur said an attacker read environment variables from its platform database after using internal credentials; it revoked tokens and advises replacing every password and key. Railway reported access to a subset of encrypted environment variables and possible decryption of some secrets, then asked customers to replace sensitive variables.
For LiteLLM, the GitHub Advisory Database lists version 1.107.0 among malicious PyPI releases. The investigations should not be conflated: their scope, causes and status differ.
Why API keys are high-value secrets
A key can grant direct access to a paid API, cloud resource, container registry or customer data. The impact can include unauthorized requests, configuration changes and access to connected systems within its permissions.
AI-provider keys are an obvious target, but the principle is the same for payment, email, cloud and crypto services. Separating keys by purpose and assigning least privilege limits the damage when one must be revoked.
A safe rotation order
First identify secrets that may have been present in the affected environment. Revoke old keys with their providers, issue replacements and update the protected secret store. After deployment, confirm the application uses the new values; only then remove old credentials from dependent systems.
Do not share keys in tickets, chats or screenshots, or with third-party verification services. For wallets, exchange APIs and payment integrations, also review limits, approved addresses and the provider-side activity log.
What to review afterward
Review provider audit logs for unusual requests, sign-ins, newly created tokens and permission changes during the period named by the affected platform. Preserve notices and the rotation time to make later investigation easier.
An incident does not prove every customer was compromised. But a provider's broad rotation recommendation usually means it cannot reliably rule out access to a particular value. In that situation, revocation and replacement are safer than waiting for a final report.
