Comment by justinai6

You know... I get it.

  Railway / OpenAI: I had a key compromised this morning. It hit our limit, so I revoked the key... and figured, well, we'll have to track down the leak.

  Then this security notice came out, telling all of their customers to rotate all their keys... As the guy whose spent the entire evening rotating keys and etc. doing

  this is... it's a huge message to send.

  The cost and implications go really far.

  We have many production services that we've taken offline or disabled because we can't deploy to fix the credentials. because of the railway deploy problem...

  Railway was stuck between some pretty nasty tradeoffs. I get that the few hour delay in communication caused some of us more cost, issues, and potential breach... and maybe larger suff.

 But I also realize that rolling the keys while things may still be compromised, with deployments blocked, could make thins even more sticky
  leaves only very bad options. Also we don't know how much they we're spending time actively stopping the attack. the time and focus could be very much consumed. if it was 5% of exposure and they prevented the 95% exposure.. i'm sure glad they aviated instead of communicated.

  We make the best decision we can in these moments..  and they all just suck.