Security update: hosting provider incident
Updated October 25, 2026.
Railway, our hosting provider, reported unauthorized access to its systems between October 20 and 22. ReviveDB runs on Railway. You do not need to do anything because of this incident.
What we know
Railway notified us that our workspace matched a search pattern used by the attacker. It has not confirmed whether our environment variables were decrypted.
Those variables gave access to our database, which holds encrypted Supabase connection tokens, and to the storage that holds recovery points. We have no evidence that customer data, tokens or recovery points were accessed. The logs available to us cannot rule it out. Railway’s investigation is ongoing.
What we have done
By October 23 we replaced all application keys, database passwords and storage credentials, and re-encrypted stored credentials with a new key. We removed public network access to our databases.
ReviveDB needs its own app credential to renew a Supabase connection. We created a new one on October 22, after Railway confirmed the attacker no longer had access, and deleted the old one on October 23. Supabase rejects renewal without the current credential, and connection tokens expire after 24 hours. Tokens from the incident period have expired and cannot be renewed.
What you need to do
Nothing because of this incident. We did not change your connections, backup schedules or recovery points.
For extra certainty, you can review your Supabase organization’s audit logs for October 20 to 24. If you see activity you do not recognize, email support@revivedb.dev.
Further updates
We will update this page if Railway’s investigation establishes additional impact.